[php-src] Issue #22787: Typo in CVE-2023-0567

[email protected] (todb) Fri, 17 Jul 2026 14:11:19 +0000
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/22787
Author: todb

### Description

In https://cveawg.mitre.org/api/cve/CVE-2023-0567, the claimed unaffected version is less than version 80.28 of PHP.

We're going to be waiting a long time for that fix, or, more likely, it's a typo and should be `8.0.28`. I've reached out to [email protected] but haven't gotten an ack back yet, so figured I'd drop a note here.

Thanks!

See:

```
"affected": [
          {
            "vendor": "php_group",
            "product": "php",
            "cpes": [
              "cpe:2.3:a:php_group:php:8.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:php_group:php:8.1.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:php_group:php:8.2.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "versions": [
              {
                "version": "8.0.0",
                "status": "affected",
                "lessThan": "80.28",
                "versionType": "semver"
              },
              {
                "version": "8.1.0",
                "status": "affected",
                "lessThan": "8.1.16",
                "versionType": "semver"
              },
              {
                "version": "8.2.0",
                "status": "affected",
                "lessThan": "8.2.3",
                "versionType": "semver"
              }
            ]
          }
        ],
```

### PHP Version

```plain
PHP 8.2.0
```

### Operating System

_No response_