Skip to content
fr Sign in
6.5 Medium

CVE-2024-3096 In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with…

Description

In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

Affected products and versions

Product Affected versions Fixed in
php 8.3.0 No fix stated
PHP 8.3 earliest → < 8.3.5 8.3.5
PHP 8.2 earliest → < 8.2.18 8.2.18
PHP 8.1 earliest → < 8.1.28 8.1.28

References

Timeline

  1. Published
  2. Last modified

Other CVEs of php

The 10 CVEs of php →
CVE-2024-11233 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error… 4.8 Medium CVE-2024-11234 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured… 4.8 Medium CVE-2024-11236 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to… 9.8 Critical CVE-2024-8929 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the… 5.8 Medium
Track this CVE