CVE-2022-24828
Fixed in a distro release EPSS 2%CVSS 8.3
Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.
Products: composer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | composer/composer | 1.10.26 |
| Packagist | composer/composer | 2.2.12 |
| Packagist | composer/composer | 2.3.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | composer | 2.2.12-1 |
| Debian 13 | composer | 2.2.12-1 |
| Debian 14 | composer | 2.2.12-1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP4 | php-composer2 | 2.2.3-150400.3.3.1 |
| SUSE Package Hub 15 SP3 | php-composer | 1.10.26-bp153.2.6.1 |
| Ubuntu Pro 16.04 LTS | composer | 1.0.0~beta2-1ubuntu0.1~esm2 |
| Ubuntu Pro 18.04 LTS | composer | 1.6.3-1ubuntu0.1~esm2 |
| Ubuntu Pro 20.04 LTS | composer | 1.10.1-1ubuntu0.1~esm2 |
| Ubuntu Pro 22.04 LTS | composer | 2.2.6-2ubuntu4+esm1 |
| Ubuntu Pro 24.04 LTS | composer | 2.7.1-2ubuntu0.1~esm1 |
| openSUSE Leap 15.3 | php-composer | 1.10.26-bp153.2.6.1 |
| openSUSE Leap 15.4 | php-composer2 | 2.2.3-150400.3.3.1 |
| openSUSE Tumbleweed | php-composer | 1.10.26-1.1 |
| openSUSE Tumbleweed | php-composer2 | 2.3.5-1.1 |