Vulnerability Description
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Getcomposer | Composer | < 1.10.27 |
| Debian | Debian Linux | 10.0 |
| Fedoraproject | Fedora | 37 |
Related Weaknesses (CWE)
References
- https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6Patch
- https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728Patch
- https://github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b9Patch
- https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hfVendor Advisory
- https://lists.debian.org/debian-lts-announce/2024/03/msg00030.htmlMailing List
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6Patch
- https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728Patch
- https://github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b9Patch
- https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hfVendor Advisory
- https://lists.debian.org/debian-lts-announce/2024/03/msg00030.htmlMailing List
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
FAQ
What is CVE-2023-43655?
CVE-2023-43655 is a vulnerability with a CVSS score of 6.4 (MEDIUM). Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execu...
How severe is CVE-2023-43655?
CVE-2023-43655 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-43655?
Check the references section above for vendor advisories and patch information. Affected products include: Getcomposer Composer, Debian Debian Linux, Fedoraproject Fedora.