CVE-2020-35184

Name of the Vulnerable Software and Affected Versions composer versions prior to 1.8.3

Description The official composer docker images contain a blank password for a root user. Systems using the composer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.

Recommendations For versions prior to 1.8.3, update to version 1.8.3 or later to resolve the issue. As a temporary workaround, consider changing the root password in the composer docker container to prevent unauthorized access. Restrict access to the composer docker container to minimize the risk of exploitation.