In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

PHP function password_verify can erroneously return true when argument contains NUL

In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before ...

password_verify can erroneously return true, opening ATO risk

Уязвимость функции password_verify() интерпретатора языка программирования PHP, позволяющая нарушителю обойти процесс аутентификации и получить несанкционированный доступ к веб-приложению

Security update for php8

Security update for php74

Security update for php7

Уязвимость php

Уязвимость php

Уязвимость php

Security update for php7

ALT-PU-2024-18408: package `php8.2-soap` update to version 8.2.18-alt1

ALT-PU-2024-18310: package `php8.1-soap` update to version 8.1.28-alt1

ALT-PU-2024-18045: package `php8.1-soap` update to version 8.1.28-alt1

ALT-PU-2024-18035: package `php8.2-soap` update to version 8.2.18-alt1

Moderate: php:8.2 security update

Moderate: php:8.1 security update