Bug#1073125: composer: CVE-2024-35241: Command injection via malicious git branch name

From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#1073125: composer: CVE-2024-35241: Command injection via malicious git branch name
Date	2024-06-13 08:20 +0200
Message-ID	<IOLYt-2yj7-1@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Source: composer
Version: 2.7.6-3
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for composer.

CVE-2024-35241[0]:
| Composer is a dependency manager for PHP. On the 2.x branch prior to
| versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove`
| commands with packages installed from source via git containing
| specially crafted branch names in the repository can be used to
| execute code. Patches for this issue are available in version 2.2.24
| for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing
| dependencies via git by using `--prefer-dist` or the `preferred-
| install: dist` config setting.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-35241
    https://www.cve.org/CVERecord?id=CVE-2024-35241
[1] https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Back to linux.debian.bugs.rc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1073125: composer: CVE-2024-35241: Command injection via malicious git branch name Salvatore Bonaccorso <carnil@debian.org> - 2024-06-13 08:20 +0200
  Bug#1073125: marked as done (composer: CVE-2024-35241: Command  injection via malicious git branch name) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-06-13 13:00 +0200
  Bug#1073125: marked as done (composer: CVE-2024-35241: Command  injection via malicious git branch name) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-06-19 20:30 +0200
  Bug#1073125: marked as done (composer: CVE-2024-35241: Command  injection via malicious git branch name) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-06-19 20:40 +0200

csiph-web