Aller au contenu
en Se connecter
8.8 Élevée

CVE-2024-35242 Composer is a dependency manager for PHP

Description

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

Produits et versions touchés

Produit Versions touchées Corrigé en
composer 2.3 2.3 → < 2.7.7 2.7.7
composer 2.0 2.0 → < 2.2.24 2.2.24
fedora 40 Pas de correctif indiqué
fedora 39 Pas de correctif indiqué
composer 2.3 2.3 → < 2.7.7 2.7.7

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de composer

Les 16 CVE de composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Moyenne CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 Élevée CVE-2026-45793 Composer is a dependency Manager for the PHP language 7.5 Élevée CVE-2026-59947 Composer is a dependency Manager for the PHP language 4.7 Moyenne
Suivre cette CVE