GHSA-v9qv-c7wm-wgmfHighCVSS 8.8
Composer has multiple command injections via malicious git/hg branch names
🔗 CVE IDs covered (1)
📋 Description
Impact
The composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. So this requires cloning untrusted repositories.
Patches
2.2.24 for 2.2 LTS or 2.7.7 for mainline
Workarounds
Avoid cloning potentially compromised repositories.
🎯 Affected products2
- composer/composer/composer:>= 2.0, < 2.2.24
- composer/composer/composer:>= 2.3, < 2.7.7
🔗 References (7)
- https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf
- https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396
- https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467
- https://nvd.nist.gov/vuln/detail/CVE-2024-35242
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC
- https://github.com/advisories/GHSA-v9qv-c7wm-wgmf