p PatchFirst

CVE-2024-35242

CVE-2024-35242 · Composer vulnerable to command injection via malicious git/hg branch names

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

CVSS 8.8 · High · EPSS 3.3% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • composer

    Versions
    • >= 2.0, < 2.2.24: Affected
    • >= 2.3, < 2.7.7: Affected

    No fix published

  • composer Debian:12

    Versions
    • 2.5.5-1
    • 2.5.5-1+deb12u1
    Affected ranges
    • ECOSYSTEM: < 2.5.5-1+deb12u2

    Update to 2.5.5-1+deb12u2

  • composer Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.7.7-1

    Update to 2.7.7-1

  • composer Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.7.7-1

    Update to 2.7.7-1

  • composer/composer Packagist

    Versions
    • 2.0.0
    • 2.0.0-RC1
    • 2.0.0-RC2
    • 2.0.0-alpha1
    • 2.0.0-alpha2
    • 2.0.0-alpha3
    • 2.0.1
    • 2.0.10
    • 2.0.11
    • 2.0.12
    • 2.0.13
    • 2.0.14
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.0.9
    • 2.1.0
    • 2.1.0-RC1
    • 2.1.1
    • 2.1.10
    • 2.1.11
    • 2.1.12
    • 2.1.14
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.1.7
    • 2.1.8
    • 2.1.9
    • 2.2.0
    • 2.2.0-RC1
    • 2.2.1
    • 2.2.10
    • 2.2.11
    • 2.2.12
    • 2.2.13
    • 2.2.14
    • 2.2.15
    • 2.2.16
    • 2.2.17
    • 2.2.18
    • 2.2.19
    • 2.2.2
    • 2.2.20
    • 2.2.21
    • 2.2.22
    • 2.2.23
    • 2.2.3
    • 2.2.4
    • 2.2.5
    • 2.2.6
    • 2.2.7
    • 2.2.8
    • 2.2.9
    Affected ranges
    • ECOSYSTEM: ≥ 2.0, < 2.2.24

    Update to 2.2.24

  • composer/composer Packagist

    Versions
    • 2.3.0
    • 2.3.0-RC1
    • 2.3.0-RC2
    • 2.3.1
    • 2.3.10
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.3.5
    • 2.3.6
    • 2.3.7
    • 2.3.8
    • 2.3.9
    • 2.4.0
    • 2.4.0-RC1
    • 2.4.1
    • 2.4.2
    • 2.4.3
    • 2.4.4
    • 2.5.0
    • 2.5.1
    • 2.5.2
    • 2.5.3
    • 2.5.4
    • 2.5.5
    • 2.5.6
    • 2.5.7
    • 2.5.8
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.6.4
    • 2.6.5
    • 2.6.6
    • 2.7.0
    • 2.7.1
    • 2.7.2
    • 2.7.3
    • 2.7.4
    • 2.7.5
    • 2.7.6
    Affected ranges
    • ECOSYSTEM: ≥ 2.3, < 2.7.7

    Update to 2.7.7

  • composer Ubuntu:Pro:16.04:LTS

    Versions
    • 1.0.0~alpha10+20150602-1
    • 1.0.0~alpha10+20150602-2
    • 1.0.0~alpha11-1
    • 1.0.0~alpha11-1ubuntu1
    • 1.0.0~alpha11-2
    • 1.0.0~alpha11-3
    • 1.0.0~beta1-1ubuntu1
    • 1.0.0~beta2-1
    • 1.0.0~beta2-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.0.0~beta2-1ubuntu0.1~esm2

    Update to 1.0.0~beta2-1ubuntu0.1~esm2

  • composer Ubuntu:Pro:18.04:LTS

    Versions
    • 1.5.1-1
    • 1.5.2-1
    • 1.6.2-1
    • 1.6.3-1
    • 1.6.3-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.6.3-1ubuntu0.1~esm2

    Update to 1.6.3-1ubuntu0.1~esm2

  • composer Ubuntu:Pro:20.04:LTS

    Versions
    • 1.9.0-2
    • 1.9.1-1
    • 1.9.2-1
    • 1.9.3-1
    • 1.10.0-1
    • 1.10.1-1
    • 1.10.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.10.1-1ubuntu0.1~esm2

    Update to 1.10.1-1ubuntu0.1~esm2

  • composer Ubuntu:Pro:22.04:LTS

    Versions
    • 2.0.9-2ubuntu2
    • 2.0.9-2ubuntu3
    • 2.0.13-1ubuntu1
    • 2.1.12-1ubuntu1
    • 2.2.6-2ubuntu4
    Affected ranges
    • ECOSYSTEM: < 2.2.6-2ubuntu4+esm1

    Update to 2.2.6-2ubuntu4+esm1

  • composer Ubuntu:Pro:24.04:LTS

    Versions
    • 2.5.8-1
    • 2.6.5-1
    • 2.6.6-1
    • 2.7.1-2
    Affected ranges
    • ECOSYSTEM: < 2.7.1-2ubuntu0.1~esm1

    Update to 2.7.1-2ubuntu0.1~esm1

Original sources

Check your server →