Update dependency composer/composer to v2.2.24 [SECURITY] #24
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.1.9->2.2.24Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2022-24828
The Composer method
VcsDriver::getFileContent()with user-controlled$fileor$identifierarguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used.This led to a vulnerability on Packagist.org and Private Packagist, i.e., using the composer.json
readmefield as a vector for injecting parameters into the$fileargument for the Mercurial driver or via the$identifierargument for the Git and Mercurial drivers.Composer itself can be attacked through branch names by anyone controlling a Git or Mercurial repository, which is explicitly listed by URL in a project's composer.json.
To the best of our knowledge, this was not actively exploited. The vulnerability has been patched on Packagist.org and Private Packagist within a day of the vulnerability report.
CVE-2023-43655
Impact
Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has
register_argc_argvenabled in php.ini.Patches
2.6.4, 2.2.22 and 1.10.27 patch this vulnerability.
Workarounds
Make sure
register_argc_argvis disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.CVE-2024-24821
Impact
Several files within the local working directory are included during the invocation of Composer and in the context of the executing user.
As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide lateral user movement or malicious code execution when Composer is invoked within a directory with tampered files.
All Composer CLI commands are affected, including composer.phar's self-update.
The following are of high risk:
Patches
2.7.0, 2.2.23
Workarounds
Where not possible, the following should be addressed:
vendor/composer/InstalledVersions.phpandvendor/composer/installed.phpdo not include untrusted code.A reset can also be done on these files by the following:
CVE-2024-35242
Impact
The
composer installcommand running inside a git/hg repository which has specially crafted branch names can lead to command injection. So this requires cloning untrusted repositories.Patches
2.2.24 for 2.2 LTS or 2.7.7 for mainline
Workarounds
Avoid cloning potentially compromised repositories.
CVE-2024-35241
Impact
The
status,reinstallandremovecommands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code.Patches
2.2.24 for 2.2 LTS or 2.7.7 for mainline
Workarounds
Avoid installing dependencies via git by using
--prefer-distor thepreferred-install: distconfig setting.Release Notes
composer/composer (composer/composer)
v2.2.24Compare Source
This release includes fixes for issues found in a security audit by Cure53 funded by Alpha-Omega.
fa3b958)3c37a67)3773f77)de5f7e3)3130a74,04a63b3)v2.2.23Compare Source
v2.2.22Compare Source
%signs (#11359)v2.2.21Compare Source
v2.2.20Compare Source
v2.2.19Compare Source
_to avoid conflicts between package names likea-banda_b(#11229)COMPOSER_DISCARD_CHANGESwhen set to0v2.2.18Compare Source
COMPOSER_NO_DEVso it also works withrequireandremove's--update-no-dev(#10995)v2.2.17Compare Source
v2.2.16Compare Source
v2.2.15Compare Source
cache-read-onlywhere the filesystem is not writable (#10906)allow-plugins: true(#10909)v2.2.14Compare Source
v2.2.13Compare Source
v2.2.12Compare Source
lockconfig option is disabled (#10726)validatecommand checking the lock file even if thelockoption is disabled (#10723)v2.2.11Compare Source
self-updateto pin the Composer version to the 2.2 LTS range (#10682)v2.2.10Compare Source
v2.2.9Compare Source
v2.2.8Compare Source
filesautoloading sort order to be fully deterministic (#10617)requirecommand failing whenself.versionis used as constraint (#10593)v2.2.7Compare Source
licensescommand output (#10537)allow-plugins: falsewhich kept warning (#10530)initcommand requiring an email whereas the schema allows a name only (#10538)requirecommand when requiring packages which do not exist (but are provided by something else you require) (#10541)v2.2.6Compare Source
COMPOSER_BIN_DIRenv var for binaries added in Composer 2.2.2 had to be renamed toCOMPOSER_RUNTIME_BIN_DIR(#10512)enum foo:stringwithout space after:(#10498)reinstallcommand not firingpre-install-cmd/post-install-cmdevents (#10514)v2.2.5Compare Source
composer/package-versions-deprecatedby default as it can function usingComposer\InstalledVersionsat runtime (#10458)v2.2.4Compare Source
v2.2.3Compare Source
v2.2.2Compare Source
COMPOSER_BIN_DIRenv var and_composer_bin_dirglobal containing the path to the bin-dir for binaries. Packages relying on finding the bin dir with$BASH_SOURCES[0]will need to update their binaries (#10402)v2.2.1Compare Source
v2.2.0Compare Source
dev-mainas the default path repo package version if no VCS info is available (#10372)v2.1.14Compare Source
v2.1.12Compare Source
9999999-dev being shown in some cases by theshowcommand (#10260)v2.1.11Compare Source
v2.1.10Compare Source
requirecommand reverting changes even though dependency resolution succeeded when something fails in scripts for example (#10118)requirenot finding the right package version when some newly required extension is missing from the system (#10167)e1dbd65)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.