Aller au contenu
en Se connecter
6.4 Moyenne

CVE-2023-43655 Composer is a dependency manager for PHP

Description

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Produits et versions touchés

Produit Versions touchées Corrigé en
composer 2.0 2.0 → < 2.2.22 2.2.22
composer 1.10 premières → < 1.10.27 1.10.27
composer 2.6 premières → 2.6.4 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de composer

Les 16 CVE de composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Moyenne CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 Élevée CVE-2026-45793 Composer is a dependency Manager for the PHP language 7.5 Élevée CVE-2026-59947 Composer is a dependency Manager for the PHP language 4.7 Moyenne
Suivre cette CVE