Approved changes feed: RSS · Atom
cpe:2.3:a:getcomposer:composer:2.0:*:*:*:*:*:*:*
part: a version: 2.0 update: *
| Vendor | Getcomposer (e0bb4b7a-2fd0-5157-8692-1e509cd674da) |
|---|---|
| Product | Composer (2295e9c1-8c0c-5a78-ada8-82d842a89fe1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-35242 |
vulnerable | 2026-06-08 06:37:35.518850 |
Composer vulnerable to command injection via malicious git/hg branch names
HIGH (8.8)
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.
Published: 2024-06-10T21:23:44.040Z
Updated: 2025-02-13T17:52:34.786Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-35241 |
vulnerable | 2026-06-08 06:37:35.516555 |
Composer vulnerable to command injection via malicious git branch name
HIGH (8.8)
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.
Published: 2024-06-10T21:19:47.123Z
Updated: 2025-04-21T15:20:35.089Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.