Skip to content
OpenAdvisories
High ALAS2023-2024-650 1 CVE

Important: composer security update (Amazon Linux 2023)

Published Jul 3, 2024 · Updated Jul 10, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35241: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 composer 0:2.5.8-2.amzn2023.0.3

Vulnerabilities 1

  • High 8.8
    CVE-2024-35241

    Composer vulnerable to command injection via malicious git branch name

    Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-35241.html