Skip to content
OpenAdvisories
High ALAS2023-2024-659 1 CVE

Important: composer security update (Amazon Linux 2023)

Published Jul 18, 2024 · Updated Jul 22, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35242: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 composer 0:2.5.8-2.amzn2023.0.4

Vulnerabilities 1

  • High 8.8
    CVE-2024-35242 Public exploit

    Composer vulnerable to command injection via malicious git/hg branch names

    Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning unt…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-35242.html