Wind River Support Network

HomeDefectsLIN1021-5250

Fixed

LIN1021-5250 : Security Advisory - php - CVE-2023-0567

Created: Feb 14, 2023 Updated: Mar 15, 2023

Resolved Date: Mar 15, 2023

Found In Version: 10.21.20.1

Fix Version: 10.21.20.17

Severity: Standard

Applicable for: Wind River Linux LTS 21

Component/s: Userspace

Description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

https://nvd.nist.gov/vuln/detail/CVE-2023-0567

CVEs

CVE-2023-0567