php8.2: CVE-2023-0567 CVE-2023-0568 CVE-2023-0662

Debian Bug report logs - #1031368
php8.2: CVE-2023-0567 CVE-2023-0568 CVE-2023-0662

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: php8.2: CVE-2023-0567 CVE-2023-0568 CVE-2023-0662

Date: Wed, 15 Feb 2023 22:26:39 +0100

Source: php8.2
Version: 8.2.2-3
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerabilities were published for php8.2, making the
bureport RC to ideally have those fixed before bookworm release goes
out.

CVE-2023-0567[0]:
| PHP: Password_verify() always return true with some hash

CVE-2023-0568[1]:
| PHP: 1-byte array overrun in common path resolve code

CVE-2023-0662[2]:
| PHP: DOS vulnerability when parsing multipart request body

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-0567
    https://www.cve.org/CVERecord?id=CVE-2023-0567
[1] https://security-tracker.debian.org/tracker/CVE-2023-0568
    https://www.cve.org/CVERecord?id=CVE-2023-0568
[2] https://security-tracker.debian.org/tracker/CVE-2023-0662
    https://www.cve.org/CVERecord?id=CVE-2023-0662

Regards,
Salvatore

Send a report that this bug log contains spam.