PT-2024-4387 · Composer+5 · Composer+5
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Composer versions prior to 2.2.24 and 2.7.7
Description
The issue is related to the
composer install command running inside a git/hg repository with specially crafted branch names, which can lead to command injection. This requires cloning untrusted repositories.Recommendations
For versions prior to 2.2.24, update to version 2.2.24 for 2.2 LTS.
For versions prior to 2.7.7, update to version 2.7.7 for mainline.
As a temporary workaround, avoid cloning potentially compromised repositories.
Exploit
Fix
DoS
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Composer
Linuxmint
Red Os
Suse
Ubuntu