Skip to content
OpenAdvisories
High USN-6053-1 1 CVE

php7.0 vulnerability

Published May 2, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PHP incorrectly handled certain invalid Blowfish
password hashes. An invalid password hash could possibly allow applications to
accept any password as valid, contrary to expectations.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS php7.0 7.0.33-0ubuntu0.16.04.16+esm6

Vulnerabilities 1

  • High 7.7
    CVE-2023-0567

    password_verify() always returns true for some invalid hashes

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any passwor…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2023-0567