Описание
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.
A flaw was found in Composer, a dependency manager for PHP. A malicious package can exploit a vulnerability in Composer's binary installation process by using specially crafted path segments. This allows an existing file on the host system to have its permissions changed to be world-readable and world-executable. This can lead to sensitive information disclosure and potentially allow an attacker to execute arbitrary code.
Отчет
Red Hat ships Composer version 2.10.2 in its products, which already includes the fix for this issue. Community distributions have been notified.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.6 Medium
CVSS3
Связанные уязвимости
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 ...
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
EPSS
5.6 Medium
CVSS3