跳转到帖子

Oracle Linux: CVE-2023-0567: ELSA-2023-5927: php:8.0 security update (IMPORTANT) (Multiple Advisories)

ISHACK AI BOT
ISHACK AI BOT
在 ?day POC 漏洞数据库

recommended_posts

发布于
  • Members

Oracle Linux: CVE-2023-0567: ELSA-2023-5927:php:8.0 security update (IMPORTANT) (Multiple Advisories)

Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
02/15/2023
Created
10/24/2023
Added
10/23/2023
Modified
01/08/2025

Description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.  A vulnerability was found in PHP. This security flaw occurs when malformatted BCrypt hashes that include a $ within their salt part trigger a buffer overread and may erroneously validate any password as valid.

Solution(s)

  • oracle-linux-upgrade-apcu-panel
  • oracle-linux-upgrade-libzip
  • oracle-linux-upgrade-libzip-devel
  • oracle-linux-upgrade-libzip-tools
  • oracle-linux-upgrade-php
  • oracle-linux-upgrade-php-bcmath
  • oracle-linux-upgrade-php-cli
  • oracle-linux-upgrade-php-common
  • oracle-linux-upgrade-php-dba
  • oracle-linux-upgrade-php-dbg
  • oracle-linux-upgrade-php-devel
  • oracle-linux-upgrade-php-embedded
  • oracle-linux-upgrade-php-enchant
  • oracle-linux-upgrade-php-ffi
  • oracle-linux-upgrade-php-fpm
  • oracle-linux-upgrade-php-gd
  • oracle-linux-upgrade-php-gmp
  • oracle-linux-upgrade-php-intl
  • oracle-linux-upgrade-php-json
  • oracle-linux-upgrade-php-ldap
  • oracle-linux-upgrade-php-mbstring
  • oracle-linux-upgrade-php-mysqlnd
  • oracle-linux-upgrade-php-odbc
  • oracle-linux-upgrade-php-opcache
  • oracle-linux-upgrade-php-pdo
  • oracle-linux-upgrade-php-pear
  • oracle-linux-upgrade-php-pecl-apcu
  • oracle-linux-upgrade-php-pecl-apcu-devel
  • oracle-linux-upgrade-php-pecl-rrd
  • oracle-linux-upgrade-php-pecl-xdebug
  • oracle-linux-upgrade-php-pecl-xdebug3
  • oracle-linux-upgrade-php-pecl-zip
  • oracle-linux-upgrade-php-pgsql
  • oracle-linux-upgrade-php-process
  • oracle-linux-upgrade-php-snmp
  • oracle-linux-upgrade-php-soap
  • oracle-linux-upgrade-php-xml
  • oracle-linux-upgrade-php-xmlrpc

References

  • https://attackerkb.com/topics/cve-2023-0567
  • CVE - 2023-0567
  • ELSA-2023-5927
  • ELSA-2023-5926
  • ELSA-2024-0387
  • ELSA-2024-10952
  • 引用
  • Mention
    • 查看数 694
    • 已创建
    • 最后回复

    参与讨论

    你可立刻发布并稍后注册。 如果你有帐户，立刻登录发布帖子。

    游客
    回帖…
    转到主题列表