FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Composer -- Command injection vulnerability

Affected packages
		php74-composer	<	1.10.26
		php80-composer	<	1.10.26
		php81-composer	<	1.10.26
2.0.0	<=	php74-composer2	<	2.2.12
2.3.0	<=	php74-composer2	<	2.3.5
2.0.0	<=	php80-composer2	<	2.2.12
2.3.0	<=	php80-composer2	<	2.3.5
2.0.0	<=	php81-composer2	<	2.2.12
2.3.0	<=	php81-composer2	<	2.3.5

Details

VuXML ID	24a9bd2b-bb43-11ec-af81-0897988a1c07
Discovery	2022-04-13
Entry	2022-04-13

Composer developers reports:

The Composer method VcsDriver::getFileContent() with user-controlled $file or $identifier arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used.

[source]

References

CVE Name	CVE-2022-24828
URL	https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6