Composer Remote Code Execution vulnerability via web-accessible composer.phar
The advisory, in context
Impact
Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has register_argc_argv enabled in php.ini.
Patches
2.6.4, 2.2.22 and 1.10.27 patch this vulnerability.
Workarounds
Make sure register_argc_argv is disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 1.10.27
Fixed in 1.10.27
95 explicitly affected versions
1.0.0, 1.0.0-alpha1, 1.0.0-alpha10, 1.0.0-alpha11, 1.0.0-alpha2, 1.0.0-alpha3, 1.0.0-alpha4, 1.0.0-alpha5, 1.0.0-alpha6, 1.0.0-alpha7, 1.0.0-alpha8, 1.0.0-alpha9, 1.0.0-beta1, 1.0.0-beta2, 1.0.1, 1.0.2, 1.0.3, 1.1.0, 1.1.0-RC, 1.1.1, 1.1.2, 1.1.3, 1.10.0, 1.10.0-RC, 1.10.1, 1.10.10, 1.10.11, 1.10.12, 1.10.13, 1.10.14, 1.10.15, 1.10.16, 1.10.17, 1.10.18, 1.10.19, 1.10.2, 1.10.20, 1.10.21, 1.10.22, 1.10.23, 1.10.24, 1.10.25, 1.10.26, 1.10.3, 1.10.4, 1.10.5, 1.10.6, 1.10.7, 1.10.8, 1.10.9, 1.2.0, 1.2.0-RC, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.3.0, 1.3.0-RC, 1.3.1, 1.3.2, 1.3.3, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.6.0, 1.6.0-RC, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.7.0, 1.7.0-RC, 1.7.1, 1.7.2, 1.7.3, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.8.6, 1.9.0, 1.9.1, 1.9.2, 1.9.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.27"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.0",
"1.0.0-alpha1",
"1.0.0-alpha10",
"1.0.0-alpha11",
"1.0.0-alpha2",
"1.0.0-alpha3",
"1.0.0-alpha4",
"1.0.0-alpha5",
"1.0.0-alpha6",
"1.0.0-alpha7",
"1.0.0-alpha8",
"1.0.0-alpha9",
"1.0.0-beta1",
"1.0.0-beta2",
"1.0.1",
"1.0.2",
"1.0.3",
"1.1.0",
"1.1.0-RC",
"1.1.1",
"1.1.2",
"1.1.3",
"1.10.0",
"1.10.0-RC",
"1.10.1",
"1.10.10",
"1.10.11",
"1.10.12",
"1.10.13",
"1.10.14",
"1.10.15",
"1.10.16",
"1.10.17",
"1.10.18",
"1.10.19",
"1.10.2",
"1.10.20",
"1.10.21",
"1.10.22",
"1.10.23",
"1.10.24",
"1.10.25",
"1.10.26",
"1.10.3",
"1.10.4",
"1.10.5",
"1.10.6",
"1.10.7",
"1.10.8",
"1.10.9",
"1.2.0",
"1.2.0-RC",
"1.2.1",
"1.2.2",
"1.2.3",
"1.2.4",
"1.3.0",
"1.3.0-RC",
"1.3.1",
"1.3.2",
"1.3.3",
"1.4.0",
"1.4.1",
"1.4.2",
"1.4.3",
"1.5.0",
"1.5.1",
"1.5.2",
"1.5.3",
"1.5.4",
"1.5.5",
"1.5.6",
"1.6.0",
"1.6.0-RC",
"1.6.1",
"1.6.2",
"1.6.3",
"1.6.4",
"1.6.5",
"1.7.0",
"1.7.0-RC",
"1.7.1",
"1.7.2",
"1.7.3",
"1.8.0",
"1.8.1",
"1.8.2",
"1.8.3",
"1.8.4",
"1.8.5",
"1.8.6",
"1.9.0",
"1.9.1",
"1.9.2",
"1.9.3"
]
}From 2.0.0 before 2.2.22
Fixed in 2.2.22
53 explicitly affected versions
2.0.0, 2.0.1, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.1.0, 2.1.0-RC1, 2.1.1, 2.1.10, 2.1.11, 2.1.12, 2.1.14, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.2.0, 2.2.0-RC1, 2.2.1, 2.2.10, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15, 2.2.16, 2.2.17, 2.2.18, 2.2.19, 2.2.2, 2.2.20, 2.2.21, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.2.22"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.0",
"2.0.1",
"2.0.10",
"2.0.11",
"2.0.12",
"2.0.13",
"2.0.14",
"2.0.2",
"2.0.3",
"2.0.4",
"2.0.5",
"2.0.6",
"2.0.7",
"2.0.8",
"2.0.9",
"2.1.0",
"2.1.0-RC1",
"2.1.1",
"2.1.10",
"2.1.11",
"2.1.12",
"2.1.14",
"2.1.2",
"2.1.3",
"2.1.4",
"2.1.5",
"2.1.6",
"2.1.7",
"2.1.8",
"2.1.9",
"2.2.0",
"2.2.0-RC1",
"2.2.1",
"2.2.10",
"2.2.11",
"2.2.12",
"2.2.13",
"2.2.14",
"2.2.15",
"2.2.16",
"2.2.17",
"2.2.18",
"2.2.19",
"2.2.2",
"2.2.20",
"2.2.21",
"2.2.3",
"2.2.4",
"2.2.5",
"2.2.6",
"2.2.7",
"2.2.8",
"2.2.9"
]
}From 2.3.0 before 2.6.4
Fixed in 2.6.4
30 explicitly affected versions
2.3.0, 2.3.1, 2.3.10, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.8, 2.3.9, 2.4.0, 2.4.0-RC1, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7, 2.5.8, 2.6.0, 2.6.1, 2.6.2, 2.6.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.6.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.3.0",
"2.3.1",
"2.3.10",
"2.3.2",
"2.3.3",
"2.3.4",
"2.3.5",
"2.3.6",
"2.3.7",
"2.3.8",
"2.3.9",
"2.4.0",
"2.4.0-RC1",
"2.4.1",
"2.4.2",
"2.4.3",
"2.4.4",
"2.5.0",
"2.5.1",
"2.5.2",
"2.5.3",
"2.5.4",
"2.5.5",
"2.5.6",
"2.5.7",
"2.5.8",
"2.6.0",
"2.6.1",
"2.6.2",
"2.6.3"
]
}References
- https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf
- https://nvd.nist.gov/vuln/detail/CVE-2023-43655
- https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d
- https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c
- https://github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9c
- https://github.com/composer/composer
- https://lists.debian.org/debian-lts-announce/2024/03/msg00030.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2