Aller au contenu
en Se connecter
8.8 Élevée

CVE-2024-35241 Composer is a dependency manager for PHP

Description

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

Produits et versions touchés

Produit Versions touchées Corrigé en
composer 2.3 2.3 → < 2.7.7 2.7.7
composer 2.0 2.0 → < 2.2.24 2.2.24
fedora 40 Pas de correctif indiqué
fedora 39 Pas de correctif indiqué
composer 2.3 2.3 → < 2.7.7 2.7.7

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de composer

Les 16 CVE de composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Moyenne CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 Élevée CVE-2026-45793 Composer is a dependency Manager for the PHP language 7.5 Élevée CVE-2026-59947 Composer is a dependency Manager for the PHP language 4.7 Moyenne
Suivre cette CVE