UBUNTU-CVE-2021-41116

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2021-41116
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-41116.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-41116
Related
Published
2021-10-05T18:15:00Z
Modified
2024-10-15T14:08:25Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.

References

Affected packages

Ubuntu:Pro:16.04:LTS / composer

Package

Name
composer
Purl
pkg:deb/ubuntu/composer?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.0~alpha10+20150602-1
1.0.0~alpha10+20150602-2
1.0.0~alpha11-1
1.0.0~alpha11-1ubuntu1
1.0.0~alpha11-2
1.0.0~alpha11-3
1.0.0~beta1-1ubuntu1
1.0.0~beta2-1
1.0.0~beta2-1ubuntu0.1~esm1

Ecosystem specific 

{
    "ubuntu_priority": "negligible"
}