CVE-2023-43655

Name of the Vulnerable Software and Affected Versions Composer versions prior to 1.10.27 Composer versions prior to 2.2.22 Composer versions prior to 2.6.4

Description The issue is related to the Composer dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has register argc argv enabled in php.ini.

Recommendations For versions prior to 1.10.27, upgrade to version 1.10.27 or later. For versions prior to 2.2.22, upgrade to version 2.2.22 or later. For versions prior to 2.6.4, upgrade to version 2.6.4 or later. As a temporary workaround, consider disabling the register argc argv setting in php.ini to minimize the risk of exploitation. Avoid publishing composer.phar to the web as this is not best practice.