CVE-2023-43655
Medium
Description
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
SeverityMedium
CVSS6.4
Exploit probability—
Product
Composer
PublishedSep 29, 2023
First seenSep 29, 2023
Weakness typeCWE-74Injection
How to fix
Update
- getcomposer composer1.10.27, 2.2.21, 2.6.4 or later
- composer/composer1.10.27, 2.2.22, 2.6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| getcomposer composer | v < 1.10.27, 2.0.0 ≤ v < 2.2.21, 2.3.0 ≤ v < 2.6.4 | 1.10.27, 2.2.21, 2.6.4 |
| debian debian_linux | 10.0 | — |
| fedoraproject fedora | 37, 38 | — |
| composer/composerPackagist | v < 1.10.27, 2.0.0 ≤ v < 2.2.22, 2.3.0 ≤ v < 2.6.4 | 1.10.27, 2.2.22, 2.6.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.