Fluid Attacks Database

Description

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	composer	>=0 <2.7.7-1	2.7.7-1
packagist	composer/composer	>=2.0 <2.2.24 \|\| >=2.3 <2.7.7	2.2.24, 2.7.7
debian 11	composer	=2.0.9-2 \|\| =2.0.9-2+deb11u1 \|\| =2.0.9-2+deb11u2 \|\| >=0 <2.0.9-2+deb11u3	2.0.9-2+deb11u3
debian 12	composer	=2.5.5-1 \|\| =2.5.5-1+deb12u1 \|\| >=0 <2.5.5-1+deb12u2	2.5.5-1+deb12u2
debian 14	composer	>=0 <2.7.7-1	2.7.7-1

Aliases

1. CVE-2024-352422. NVD-2024-352423. OSV-DEBIAN-2024-352424. OSV-2024-352425. GHSA-v9qv-c7wm-wgmf6. GCVE-2024-352427. SECURITY-TRACKER-CVE-2024-35242

References

1. https://github.com/KKkai0315/CVE-2024-352422. https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf3. https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a3964. https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb4675. https://lists.fedoraproject.org/archives/list/[email protected]/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC6. https://lists.fedoraproject.org/archives/list/[email protected]/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.