USN-7603-1

Dashboard / Vulnerabilities / USN-7603-1

USN-7603-1

Summary: composer vulnerabilities

Details: Thomas Chauchefoin discovered that Composer did not correctly handle certain arguments. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24828, CVE-2023-43655) Ed Cradock discovered that Composer did not correctly handle the exclusion of certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-24821) Martin Haunschmid discovered that Composer did not correctly handle git branch names. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-35241) Maciej Piechota discovered that Composer did not correctly handle VCS branch names. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-35242)

References: https://ubuntu.com/security/notices/USN-7603-1, https://ubuntu.com/security/CVE-2022-24828, https://ubuntu.com/security/CVE-2023-43655, https://ubuntu.com/security/CVE-2024-24821, https://ubuntu.com/security/CVE-2024-35241, https://ubuntu.com/security/CVE-2024-35242