Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.rc > #365136 > unrolled thread

Bug#1073126: composer: CVE-2024-35242: Multiple command injections via malicious git/hg branch names

Back to article view | Back to linux.debian.bugs.rc

Contents

  Bug#1073126: composer: CVE-2024-35242: Multiple command injections via malicious git/hg branch names Salvatore Bonaccorso <carnil@debian.org> - 2024-06-13 08:30 +0200
    Bug#1073126: marked as done (composer: CVE-2024-35242: Multiple  command injections via malicious git/hg branch names) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-06-13 13:00 +0200
    Bug#1073126: marked as done (composer: CVE-2024-35242: Multiple  command injections via malicious git/hg branch names) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-06-19 20:30 +0200
    Bug#1073126: marked as done (composer: CVE-2024-35242: Multiple  command injections via malicious git/hg branch names) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-06-19 20:40 +0200

#365136 — Bug#1073126: composer: CVE-2024-35242: Multiple command injections via malicious git/hg branch names

Source: composer
Version: 2.7.6-3
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for composer.

CVE-2024-35242[0]:
| Composer is a dependency manager for PHP. On the 2.x branch prior to
| versions 2.2.24 and 2.7.7, the `composer install` command running
| inside a git/hg repository which has specially crafted branch names
| can lead to command injection. This requires cloning untrusted
| repositories. Patches are available in version 2.2.24 for 2.2 LTS or
| 2.7.7 for mainline. As a workaround, avoid cloning potentially
| compromised repositories.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-35242
    https://www.cve.org/CVERecord?id=CVE-2024-35242
[1] https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

[toc] | [next] | [standalone]

#365144 — Bug#1073126: marked as done (composer: CVE-2024-35242: Multiple command injections via malicious git/hg branch names)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Thu, 13 Jun 2024 10:49:12 +0000
with message-id <E1sHi12-00EK51-Jy@fasolo.debian.org>
and subject line Bug#1073126: fixed in composer 2.7.7-1
has caused the Debian Bug report #1073126,
regarding composer: CVE-2024-35242: Multiple command injections via malicious git/hg branch names
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1073126: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1073126
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#365580 — Bug#1073126: marked as done (composer: CVE-2024-35242: Multiple command injections via malicious git/hg branch names)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Wed, 19 Jun 2024 18:17:10 +0000
with message-id <E1sJzrq-006ZpX-10@fasolo.debian.org>
and subject line Bug#1073126: fixed in composer 2.5.5-1+deb12u2
has caused the Debian Bug report #1073126,
regarding composer: CVE-2024-35242: Multiple command injections via malicious git/hg branch names
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1073126: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1073126
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#365585 — Bug#1073126: marked as done (composer: CVE-2024-35242: Multiple command injections via malicious git/hg branch names)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Wed, 19 Jun 2024 18:32:34 +0000
with message-id <E1sK06k-006cpd-S7@fasolo.debian.org>
and subject line Bug#1073126: fixed in composer 2.0.9-2+deb11u3
has caused the Debian Bug report #1073126,
regarding composer: CVE-2024-35242: Multiple command injections via malicious git/hg branch names
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1073126: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1073126
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.rc

csiph-web