Fluid Attacks Database

Description

In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	php8.2	=8.2.10-1 \|\| =8.2.10-2 \|\| =8.2.12-1 \|\| =8.2.16-1 \|\| =8.2.16-2 \|\| =8.2.17-1 \|\| =8.2.5-2 \|\| =8.2.7-1 \|\| =8.2.7-1.1 \|\| =8.2.7-1.2 \|\| =8.2.7-1~deb12u1 \|\| >=0 <8.2.18-1~deb12u1	8.2.18-1~deb12u1
rpm rhel9	php	<0:8.0.30-2.el9	0:8.0.30-2.el9
rpm rhel7	php	-	-
rpm rhel8	php	<0:7.4.33-2.module+el8.10.0+22485+a3539972	0:7.4.33-2.module+el8.10.0+22485+a3539972
rpm rhel6	php	-	-
packagist	php	>=8.1.0 <8.1.28 \|\| >=8.2.0 <8.2.18 \|\| >=8.3.0 <8.3.5	8.1.28, 8.2.18, 8.3.5

Aliases

1. CVE-2024-30962. NVD-2024-30963. OSV-DEBIAN-2024-30964. OSV-2024-30965. GCVE-2024-30966. SECURITY-TRACKER-CVE-2024-30967. lists.debian.org8. https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3096.json9. GHSA-h746-cjrr-wfmr10. security.netapp.com

References

1. http://www.openwall.com/lists/oss-security/2024/04/12/112. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/3. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.