Command Injection in composer - CVE-2024-35242

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU91685

Command Injection in composer - CVE-2024-35242

Published: June 11, 2024 / Updated: July 2, 2024


Vulnerability identifier: #VU91685
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-35242
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details


Affected software

composer
SUSE Linux Enterprise Server 15 SP6
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Manager Server
Fedora
SUSE Linux Enterprise Server 15 SP4 LTSS
Web and Scripting Module
openSUSE Leap
Ubuntu
composer (Ubuntu package)
composer (Debian package)
php-composer2
composer

How to mitigate CVE-2024-35242

Install updates from vendor's website.

composer - addressed in versions 2.2.24, 2.7.7
composer (Ubuntu package) - addressed in versions 1.0.0~beta2-1ubuntu0.1~esm2, 1.6.3-1ubuntu0.1~esm2, 1.10.1-1ubuntu0.1~esm2, 2.2.6-2ubuntu4+esm1, 2.7.1-2ubuntu0.1~esm1
composer (Debian package) - addressed in versions 2.0.9-2+deb11u3, 2.5.5-1+deb12u2
php-composer2 - addressed in versions 2.2.3-150400.3.12.1, 2.6.4-150600.3.3.1, 2.6.4-150600.3.12.1
composer - addressed in versions 2.7.7-1.el9, 2.7.7-1.fc39, 2.7.7-1.fc40

External References

Related Security Bulletins