I'm actually quite surprised at the initial response by the PHP Core to this vulnerability. At very least I would have thought a sensible approach would be to fail securely - so if supplied with a bad hash you return false, not true!
Many comments here vastly overstate the seriousness of this. For it to be used as an attack, the attacker needs general write access to your database. You probably have much bigger issues on your hands if that is the case.<p>If they have write access they can already just set the hash to a known value for the same result.<p>It’s a bug certainly but of very little practical security concern.
More info: <a href="https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4">https://github.com/php/php-src/security/advisories/GHSA-7fj2...</a><p>seems to be caused by a strange non-std php-specific crypto implementation
That's interesting, but i don't see how this can actually be leveraged into a vulnerability.<p>But gosh, between this and the sha with null truncating bcrypt bug, php has had bad luck implementing password routines.
<p><pre><code> This issue is caused by a PHP specific modification to the crypt_blowfish implementation
that is fittingly named “PHP hack”:
php-src/ext/standard/crypt_blowfish.c
Line 374 in 2740920
if (tmp == '$') break; /* PHP hack */
</code></pre>
Cheeky hacker.
The GitHub advisory is a better location to point this submission to: <a href="https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4">https://github.com/php/php-src/security/advisories/GHSA-7fj2...</a>
password_verify was erroneously returning true for include hashes. In the most common case where the user gives you a password and you immediately hash it and call password_verify this doesn't come up, but any case where an attacker can influence the hash is at risk (ex: hashing on the client).<p>The first comment on the bug report is pretty depressing.
Still one of the best blog articles ever written: "PHP: a fractal of bad design" <a href="https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/" rel="nofollow">https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/</a>
For some reason when ever I've had to work with PHP which was last about 10 years ago I got giggles & "TNT" by ACDC would play in my head. I'm remembering why...<p>P.H.P<p>DYNAMITE