Most recent entries from all

bdu:2022-02944

BIT-composer-2022-24828 — Missing input validation can lead to command execution in composer

Affected: Bitnami: composer

Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

certfr-2022-avi-370 — De multiples vulnérabilités ont été découvertes dans Tenable.sc. Certaines d'entre elles permettent à un attaquant de p…

certfr-2022-avi-370

CLEANSTART-2024-VD23894 — Composer is a dependency manager for the PHP programming language

Affected: CleanStart: composer

Security vulnerability affects the composer package. Composer is a dependency manager for the PHP programming language.

EUVD-2026-234259

fkie_cve-2022-24828

GHSA-x7cr-6qr6-2hh6 — Missing input validation can lead to command execution in composer

Affected: Packagist: composer/composer

The Composer method `VcsDriver::getFileContent()` with user-controlled `$file` or `$identifier` arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used.

This led to a vulnerability on Packagist.org and Private Packagist, i.e., using the composer.json `readme` field as a vector for injecting parameters into the `$file` argument for the Mercurial driver or via the `$identifier` argument for the Git and Mercurial drivers.

Composer itself can be attacked through branch names by anyone controlling a Git or Mercurial repository, which is explicitly listed by URL in a project's composer.json.

To the best of our knowledge, this was not actively exploited. The vulnerability has been patched on Packagist.org and Private Packagist within a day of the vulnerability report.

gsd-2022-24828

openSUSE-SU-2022:0132-1 — Security update for php-composer

Security update for php-composer

UBUNTU-CVE-2022-24828

Affected: Ubuntu:Pro:16.04:LTS: composer, Ubuntu:Pro:18.04:LTS: composer, Ubuntu:Pro:20.04:LTS: composer, Ubuntu:Pro:22.04:LTS: composer