Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.rc > #365135 > unrolled thread

Bug#1073125: composer: CVE-2024-35241: Command injection via malicious git branch name

Back to article view | Back to linux.debian.bugs.rc

Contents

  Bug#1073125: composer: CVE-2024-35241: Command injection via malicious git branch name Salvatore Bonaccorso <carnil@debian.org> - 2024-06-13 08:20 +0200
    Bug#1073125: marked as done (composer: CVE-2024-35241: Command  injection via malicious git branch name) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-06-13 13:00 +0200
    Bug#1073125: marked as done (composer: CVE-2024-35241: Command  injection via malicious git branch name) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-06-19 20:30 +0200
    Bug#1073125: marked as done (composer: CVE-2024-35241: Command  injection via malicious git branch name) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-06-19 20:40 +0200

#365135 — Bug#1073125: composer: CVE-2024-35241: Command injection via malicious git branch name

Source: composer
Version: 2.7.6-3
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for composer.

CVE-2024-35241[0]:
| Composer is a dependency manager for PHP. On the 2.x branch prior to
| versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove`
| commands with packages installed from source via git containing
| specially crafted branch names in the repository can be used to
| execute code. Patches for this issue are available in version 2.2.24
| for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing
| dependencies via git by using `--prefer-dist` or the `preferred-
| install: dist` config setting.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-35241
    https://www.cve.org/CVERecord?id=CVE-2024-35241
[1] https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

[toc] | [next] | [standalone]

#365143 — Bug#1073125: marked as done (composer: CVE-2024-35241: Command injection via malicious git branch name)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Thu, 13 Jun 2024 10:49:12 +0000
with message-id <E1sHi12-00EK4w-IB@fasolo.debian.org>
and subject line Bug#1073125: fixed in composer 2.7.7-1
has caused the Debian Bug report #1073125,
regarding composer: CVE-2024-35241: Command injection via malicious git branch name
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1073125: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1073125
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#365581 — Bug#1073125: marked as done (composer: CVE-2024-35241: Command injection via malicious git branch name)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Wed, 19 Jun 2024 18:17:09 +0000
with message-id <E1sJzrp-006ZpS-VJ@fasolo.debian.org>
and subject line Bug#1073125: fixed in composer 2.5.5-1+deb12u2
has caused the Debian Bug report #1073125,
regarding composer: CVE-2024-35241: Command injection via malicious git branch name
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1073125: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1073125
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#365582 — Bug#1073125: marked as done (composer: CVE-2024-35241: Command injection via malicious git branch name)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Wed, 19 Jun 2024 18:32:34 +0000
with message-id <E1sK06k-006cpY-Pz@fasolo.debian.org>
and subject line Bug#1073125: fixed in composer 2.0.9-2+deb11u3
has caused the Debian Bug report #1073125,
regarding composer: CVE-2024-35241: Command injection via malicious git branch name
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1073125: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1073125
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.rc

csiph-web