GoogleOSV:GHSA-V9QV-C7WM-WGMFComposer has multiple command injections via malicious git/hg branch names
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.2 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
15.6%
Impact
The composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. So this requires cloning untrusted repositories.
Patches
2.2.24 for 2.2 LTS or 2.7.7 for mainline
Workarounds
Avoid cloning potentially compromised repositories.
References
github.com/composer/composer
github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396
github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467
github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf
lists.fedoraproject.org/archives/list/[email protected]/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC
lists.fedoraproject.org/archives/list/[email protected]/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC
nvd.nist.gov/vuln/detail/CVE-2024-35242
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.2 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
15.6%