{"id":"MGASA-2023-0065","summary":"Updated php packages fix security vulnerability","details":"The password_verify() function may accept some invalid Blowfish hashes as\nvalid. If such invalid hash ever ends up in the password database, it may\nlead to an application allowing any password for this entry as valid.\n(CVE-2023-0567)\nThe core path resolution function allocates a buffer one byte too small.\nWhen resolving paths with lengths close to system MAXPATHLEN setting, this\nmay lead to the byte after the allocated buffer being overwritten with NUL\nvalue, which might lead to unauthorized data access or modification.\n(CVE-2023-0568)\nExcessive number of parts in HTTP form upload can cause high resource\nconsumption and excessive number of log entries. This can cause denial of\nservice on the affected server by exhausting CPU resources or disk space.\n(CVE-2023-0662)\n","modified":"2026-02-01T08:18:55.083798Z","published":"2023-02-27T20:27:16Z","related":["CVE-2023-0567","CVE-2023-0568","CVE-2023-0662"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2023-0065.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=31549"},{"type":"REPORT","url":"https://www.php.net/ChangeLog-8.php#8.0.28"}],"affected":[{"package":{"name":"php","ecosystem":"Mageia:8","purl":"pkg:rpm/mageia/php?arch=source&distro=mageia-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.28-1.mga8"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2023-0065.json"}}],"schema_version":"1.7.3","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}