CVE-2024-35241

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using --prefer-dist or the preferred-install: dist config setting.

References

Affected packages

Git / github.com/composer/composer

Affected ranges

Type: GIT
Repo: https://github.com/composer/composer
Events: Introduced

378b34c5e33c71d194f33e1b73a62ba22148ff13

Fixed

91d9d38ebc274267f952ee1fd3892dc7962075f4

Type: GIT
Repo: https://github.com/composer/composer
Events: Introduced

934ee6eed3c3ffd0aeccef7c1d255adcf0752b24

Fixed

291942978f39435cf904d33739f98d7d4eca7b23

Affected versions

2.*

2.2.11

2.2.12

2.2.13

2.2.14

2.2.15

2.2.16

2.2.17

2.3.0

2.3.1

2.3.10

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.4.0

2.4.0-RC1

2.4.1

2.4.2

2.4.3

2.4.4

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.5.8

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.7.6

Git / github.com/composer/composer

Affected ranges

Database specific

{
    "unresolved_versions": [
        {
            "events": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "39"
                }
            ],
            "type": ""
        },
        {
            "events": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "40"
                }
            ],
            "type": ""
        }
    ]
}

Git / github.com/composer/composer

Affected ranges

Type: GIT
Repo: https://github.com/composer/composer
Events: Introduced

378b34c5e33c71d194f33e1b73a62ba22148ff13

Fixed

91d9d38ebc274267f952ee1fd3892dc7962075f4

Git / github.com/composer/composer

Affected ranges

Type: GIT
Repo: https://github.com/composer/composer
Events: Introduced

934ee6eed3c3ffd0aeccef7c1d255adcf0752b24

Fixed

291942978f39435cf904d33739f98d7d4eca7b23

Affected versions

2.*

2.2.11

2.2.12

2.2.13

2.2.14

2.2.15

2.2.16

2.2.17

2.3.0

2.3.1

2.3.10

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.4.0

2.4.0-RC1

2.4.1

2.4.2

2.4.3

2.4.4

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.5.8

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.7.6