CVE-2023-43655

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has register_argc_argv enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure register_argc_argv is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/blob/cc431b3424123d84bcd7afd4de150b33f117a8ef/cves/2023/43xxx/CVE-2023-43655.json",
    "cwe_ids": [
        "CWE-74"
    ]
}

References

Affected packages

Git / github.com/composer/composer

Affected ranges

Type

GIT

Repo

https://github.com/composer/composer

Events

Introduced

378b34c5e33c71d194f33e1b73a62ba22148ff13

Fixed

fedc76ee3f3e3d57d20993b9f4c5fcfb2f8596aa

Database specific

{
    "versions": [
        {
            "introduced": "2.0"
        },
        {
            "fixed": "2.2.22"
        }
    ]
}

Type

GIT

Repo

https://github.com/composer/composer

Events

Introduced

Fixed

f8f49191eec76f039b466aa1f161406fe43aff50

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.10.27"
        }
    ]
}