CVE-2024-3096

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-3096
In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
CVSS

No CVSS.

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/04/12/11 Mailing List
http://www.openwall.com/lists/oss-security/2024/04/12/11 Mailing List
https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr Exploit Vendor Advisory
https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr Exploit Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html Mailing List
https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html Mailing List
https://security.netapp.com/advisory/ntap-20240510-0010/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20240510-0010/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

18 Jun 2025, 21:10

Type Values Removed Values Added
CWE NVD-CWE-noinfo
First Time Php
Php php
Debian debian Linux
Debian
CPE cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
References () http://www.openwall.com/lists/oss-security/2024/04/12/11 - () http://www.openwall.com/lists/oss-security/2024/04/12/11 - Mailing List
References () https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr - () https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr - Exploit, Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html - () https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html - Mailing List
References () https://security.netapp.com/advisory/ntap-20240510-0010/ - () https://security.netapp.com/advisory/ntap-20240510-0010/ - Third Party Advisory

13 Feb 2025, 18:18

Type Values Removed Values Added
Summary In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true. In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

10 Jun 2024, 18:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240510-0010/ -

08 May 2024, 01:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html -

01 May 2024, 17:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/04/12/11 -

29 Apr 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-29 04:15

Updated : 2025-06-18 21:10

NVD link : CVE-2024-3096

Mitre link : CVE-2024-3096

JSON object : View

Products Affected

php

  • php

debian

  • debian_linux
CWE
NVD-CWE-noinfo