Log in Start free

Vulnerability · Published Jun 10, 2024 · Assigned by GitHub_M

CVE-2024-35241Composer vulnerable to command injection via malicious git branch name

High 8.8

In plain English

A high-severity command injection in composer from composer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.1%top 35.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20composer2.7.7-r0ALPINE-CVE-2024-35241
Alpine:v3.21composer2.7.7-r0ALPINE-CVE-2024-35241
Alpine:v3.22composer2.7.7-r0ALPINE-CVE-2024-35241
Alpine:v3.23composer2.7.7-r0ALPINE-CVE-2024-35241
Alpine:v3.24composer2.7.7-r0ALPINE-CVE-2024-35241
Debian:12composer2.5.5-1+deb12u2DSA-5715-1
Debian:12composer2.5.5-1+deb12u2DEBIAN-CVE-2024-35241
Debian:13composer2.7.7-1DEBIAN-CVE-2024-35241
Debian:14composer2.7.7-1DEBIAN-CVE-2024-35241
Packagistcomposer/composer2.2.24GHSA-47f6-5gq3-vx9c
Packagistcomposer/composer2.7.7GHSA-47f6-5gq3-vx9c

Affected products (as reported)

VendorProductVersions
composer composer >= 2.0, < 2.2.24>= 2.3, < 2.7.7

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References