p PatchFirst

CVE-2024-35241

CVE-2024-35241 · Composer vulnerable to command injection via malicious git branch name

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

CVSS 8.8 · High · EPSS 1.1% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • composer

    Versions
    • >= 2.0, < 2.2.24: Affected
    • >= 2.3, < 2.7.7: Affected

    No fix published

  • composer Debian:12

    Versions
    • 2.5.5-1
    • 2.5.5-1+deb12u1
    Affected ranges
    • ECOSYSTEM: < 2.5.5-1+deb12u2

    Update to 2.5.5-1+deb12u2

  • composer Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.7.7-1

    Update to 2.7.7-1

  • composer Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.7.7-1

    Update to 2.7.7-1

  • composer/composer Packagist

    Versions
    • 2.0.0
    • 2.0.0-RC1
    • 2.0.0-RC2
    • 2.0.0-alpha1
    • 2.0.0-alpha2
    • 2.0.0-alpha3
    • 2.0.1
    • 2.0.10
    • 2.0.11
    • 2.0.12
    • 2.0.13
    • 2.0.14
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.0.9
    • 2.1.0
    • 2.1.0-RC1
    • 2.1.1
    • 2.1.10
    • 2.1.11
    • 2.1.12
    • 2.1.14
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.1.7
    • 2.1.8
    • 2.1.9
    • 2.2.0
    • 2.2.0-RC1
    • 2.2.1
    • 2.2.10
    • 2.2.11
    • 2.2.12
    • 2.2.13
    • 2.2.14
    • 2.2.15
    • 2.2.16
    • 2.2.17
    • 2.2.18
    • 2.2.19
    • 2.2.2
    • 2.2.20
    • 2.2.21
    • 2.2.22
    • 2.2.23
    • 2.2.3
    • 2.2.4
    • 2.2.5
    • 2.2.6
    • 2.2.7
    • 2.2.8
    • 2.2.9
    Affected ranges
    • ECOSYSTEM: ≥ 2.0, < 2.2.24

    Update to 2.2.24

  • composer/composer Packagist

    Versions
    • 2.3.0
    • 2.3.0-RC1
    • 2.3.0-RC2
    • 2.3.1
    • 2.3.10
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.3.5
    • 2.3.6
    • 2.3.7
    • 2.3.8
    • 2.3.9
    • 2.4.0
    • 2.4.0-RC1
    • 2.4.1
    • 2.4.2
    • 2.4.3
    • 2.4.4
    • 2.5.0
    • 2.5.1
    • 2.5.2
    • 2.5.3
    • 2.5.4
    • 2.5.5
    • 2.5.6
    • 2.5.7
    • 2.5.8
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.6.4
    • 2.6.5
    • 2.6.6
    • 2.7.0
    • 2.7.1
    • 2.7.2
    • 2.7.3
    • 2.7.4
    • 2.7.5
    • 2.7.6
    Affected ranges
    • ECOSYSTEM: ≥ 2.3, < 2.7.7

    Update to 2.7.7

  • composer Ubuntu:Pro:16.04:LTS

    Versions
    • 1.0.0~alpha10+20150602-1
    • 1.0.0~alpha10+20150602-2
    • 1.0.0~alpha11-1
    • 1.0.0~alpha11-1ubuntu1
    • 1.0.0~alpha11-2
    • 1.0.0~alpha11-3
    • 1.0.0~beta1-1ubuntu1
    • 1.0.0~beta2-1
    • 1.0.0~beta2-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.0.0~beta2-1ubuntu0.1~esm2

    Update to 1.0.0~beta2-1ubuntu0.1~esm2

  • composer Ubuntu:Pro:18.04:LTS

    Versions
    • 1.5.1-1
    • 1.5.2-1
    • 1.6.2-1
    • 1.6.3-1
    • 1.6.3-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.6.3-1ubuntu0.1~esm2

    Update to 1.6.3-1ubuntu0.1~esm2

  • composer Ubuntu:Pro:20.04:LTS

    Versions
    • 1.9.0-2
    • 1.9.1-1
    • 1.9.2-1
    • 1.9.3-1
    • 1.10.0-1
    • 1.10.1-1
    • 1.10.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.10.1-1ubuntu0.1~esm2

    Update to 1.10.1-1ubuntu0.1~esm2

  • composer Ubuntu:Pro:22.04:LTS

    Versions
    • 2.0.9-2ubuntu2
    • 2.0.9-2ubuntu3
    • 2.0.13-1ubuntu1
    • 2.1.12-1ubuntu1
    • 2.2.6-2ubuntu4
    Affected ranges
    • ECOSYSTEM: < 2.2.6-2ubuntu4+esm1

    Update to 2.2.6-2ubuntu4+esm1

  • composer Ubuntu:Pro:24.04:LTS

    Versions
    • 2.5.8-1
    • 2.6.5-1
    • 2.6.6-1
    • 2.7.1-2
    Affected ranges
    • ECOSYSTEM: < 2.7.1-2ubuntu0.1~esm1

    Update to 2.7.1-2ubuntu0.1~esm1

Original sources

Check your server →