CVE-2023-43655
Fixed in a distro release EPSS 2%CVSS 6.4
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
Products: composer, docker composer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | composer/composer | 1.10.27 |
| Packagist | composer/composer | 2.2.22 |
| Packagist | composer/composer | 2.6.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | composer | 1.8.4-1+deb10u3 |
| Debian 12 | composer | 2.5.5-1+deb12u4 |
| Debian 13 | composer | 2.6.4-1 |
| Debian 14 | composer | 2.6.4-1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP4 | php-composer2 | 2.2.3-150400.3.6.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | php-composer2 | 2.2.3-150400.3.6.1 |
| Ubuntu Pro 16.04 LTS | composer | 1.0.0~beta2-1ubuntu0.1~esm2 |
| Ubuntu Pro 18.04 LTS | composer | 1.6.3-1ubuntu0.1~esm2 |
| Ubuntu Pro 20.04 LTS | composer | 1.10.1-1ubuntu0.1~esm2 |
| Ubuntu Pro 22.04 LTS | composer | 2.2.6-2ubuntu4+esm1 |
| Ubuntu Pro 24.04 LTS | composer | 2.7.1-2ubuntu0.1~esm1 |
| openSUSE Leap 15.4 | php-composer2 | 2.2.3-150400.3.6.1 |
| openSUSE Leap 15.5 | php-composer2 | 2.2.3-150400.3.6.1 |
| openSUSE Tumbleweed | php-composer2 | 2.6.4-1.1 |