CVE-2024-35241

Name	CVE-2024-35241
Description	Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3838-1, DSA-5715-1
Debian Bugs	1073125

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
composer (PTS)	bullseye (security), bullseye	2.0.9-2+deb11u4	fixed
	bookworm, bookworm (security)	2.5.5-1+deb12u2	fixed
	trixie	2.8.1-1	fixed
	sid	2.8.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
composer	source	buster	1.8.4-1+deb10u4	DLA-3838-1
composer	source	bullseye	2.0.9-2+deb11u3	DSA-5715-1
composer	source	bookworm	2.5.5-1+deb12u2	DSA-5715-1
composer	source	(unstable)	2.7.7-1		1073125

Notes

https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4 (2.2.24)
https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704 (2.7.7)