CVE-2024-35242

2024-06-1022:15:09

Debian Security Bug Tracker

security-tracker.debian.org

composer dependency manager

php

command injection

git repository

mercurial repository

security patch

version 2.2.24

version 2.7.7

vulnerability

workaround

untrusted repositories

unix

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

OSVersionArchitecturePackageVersionFilename
Debian12allcomposer< 2.5.5-1+deb12u2composer_2.5.5-1+deb12u2_all.deb
Debian11allcomposer< 2.0.9-2+deb11u3composer_2.0.9-2+deb11u3_all.deb
Debian10allcomposer< 1.8.4-1+deb10u4composer_1.8.4-1+deb10u4_all.deb
Debian999allcomposer< 2.7.7-1composer_2.7.7-1_all.deb
Debian13allcomposer< 2.7.7-1composer_2.7.7-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	composer	< 2.5.5-1+deb12u2	composer_2.5.5-1+deb12u2_all.deb
Debian	11	all	composer	< 2.0.9-2+deb11u3	composer_2.0.9-2+deb11u3_all.deb
Debian	10	all	composer	< 1.8.4-1+deb10u4	composer_1.8.4-1+deb10u4_all.deb
Debian	999	all	composer	< 2.7.7-1	composer_2.7.7-1_all.deb
Debian	13	all	composer	< 2.7.7-1	composer_2.7.7-1_all.deb