Packagist/codeigniter4/shield CVE-2023-27580: medium 5.9, EPSS 0.52%

Password Shucking Vulnerability

Action: Upgrade codeigniter4/shield to 1.0.0-beta.4 or later.

composer require codeigniter4/shield:1.0.0-beta.4

Affected

Fixed versions

Sources

• osv: GHSA-c5vj-f36q-p9vg
• https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg
• https://nvd.nist.gov/vuln/detail/CVE-2023-27580
• https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b
• https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html
• https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords
• https://github.com/codeigniter4/shield
• https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md
• https://www.scottbrady91.com/authentication/beware-of-password-shucking

CVE-2023-27580 · published 2023-03-13T20:51:07Z · modified 2023-11-08T04:12:06.767774Z · JSON