UBUNTU-CVE-2023-43655

    Dashboard / Vulnerabilities / UBUNTU-CVE-2023-43655

    UBUNTU-CVE-2023-43655

    Published: 29 Sept 2023Last Modified: 5 Feb 2026
    Upstream:
    CVE-2023-43655
    Aliases:
    USN-7603-1

    Summary:

    Details: Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

    References: https://ubuntu.com/security/CVE-2023-43655, https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf, https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d, https://github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9c, https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c, https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c, https://github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9c, https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d, https://www.cve.org/CVERecord?id=CVE-2023-43655, https://ubuntu.com/security/notices/USN-7603-1

    Affected packages

    Package

    Name: composer

    Purl: pkg:deb/ubuntu/[email protected]~beta2-1ubuntu0.1~esm2?arch=source&distro=esm-apps/xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.0.0~beta2-1ubuntu0.1~esm2

    Affected versions

    1.0.0~alpha10+20150602-1
    1.0.0~alpha10+20150602-2
    1.0.0~alpha11-1
    1.0.0~alpha11-1ubuntu1
    1.0.0~alpha11-2
    1.0.0~alpha11-3
    1.0.0~beta1-1ubuntu1
    1.0.0~beta2-1
    1.0.0~beta2-1ubuntu0.1~esm1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2023-43655 | CVE-DB