Skip to content
OpenAdvisories
Medium ALAS2023-2023-384 1 CVE

Moderate: composer security update (Amazon Linux 2023)

Published Oct 12, 2023 · Updated Oct 24, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-43655: Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 composer 0:2.5.8-2.amzn2023.0.1

Vulnerabilities 1

  • Medium 6.4
    CVE-2023-43655

    Remote Code Execution via web-accessible composer.phar

    Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` ena…

    composer composer composer/composer composer Debian Ubuntu Alpine Packagist

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-43655.html