Fixed
Created: Apr 11, 2024
Updated: Dec 11, 2024
Resolved Date: Jun 16, 2024
Found In Version: 10.19.45.1
Fix Version: 10.19.45.32
Severity: Standard
Applicable for: Wind River Linux LTS 19
Component/s: Userspace
In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
https://nvd.nist.gov/vuln/detail/CVE-2024-3096
