CVE-2024-35241

CVSS V2 None CVSS V3 None
Description
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.
Overview
  • CVE ID
  • CVE-2024-35241
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-06-10T21:19:47.123Z
  • Last Modified Date
  • 2024-06-10T21:19:47.123Z
Weakness Enumerations
CWE URL
CWE-77 http://cwe.mitre.org/data/definitions/77.html
References
Reference URL Reference Tags
https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c x_refsource_CONFIRM
https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4 x_refsource_MISC
https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704 x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-35241
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35241
History
Created Old Value New Value Data Type Notes
2024-06-26 13:22:56 Added to TrackCVE