CVE-2023-43655

NameCVE-2023-43655
DescriptionComposer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
composer (PTS)buster1.8.4-1+deb10u2vulnerable
buster (security)1.8.4-1+deb10u1vulnerable
bullseye2.0.9-2+deb11u1vulnerable
bullseye (security)2.0.9-2+deb11u2vulnerable
bookworm2.5.5-1vulnerable
bookworm (security)2.5.5-1+deb12u1vulnerable
sid, trixie2.7.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
composersource(unstable)2.6.4-1

Notes

[bookworm] - composer <no-dsa> (Minor issue)
[bullseye] - composer <no-dsa> (Minor issue)
[buster] - composer <no-dsa> (Minor issue, only a problem when configured improperly)
https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf
https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d (1.10.27)
https://github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9c (2.2.22)
https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c (2.6.4)

Search for package or bug name: Reporting problems