High severity8.8OSV Advisory· Published Jun 10, 2024· Updated Apr 15, 2026
CVE-2024-35242
CVE-2024-35242
Description
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
composer/composerPackagist | >= 2.0, < 2.2.24 | 2.2.24 |
composer/composerPackagist | >= 2.3, < 2.7.7 | 2.7.7 |
Affected products
15- osv-coords14 versionspkg:apk/chainguard/composerpkg:apk/wolfi/composerpkg:bitnami/composerpkg:composer/composer/composerpkg:rpm/opensuse/php-composer2&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/php-composer2&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/php-composer2&distro=openSUSE%20Tumbleweedpkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP5pkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP6pkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/php-composer2&distro=SUSE%20Manager%20Server%204.3
< 2.7.7-r0+ 13 more
- (no CPE)range: < 2.7.7-r0
- (no CPE)range: < 2.7.7-r0
- (no CPE)range: >= 2.0.0, < 2.2.24
- (no CPE)range: >= 2.0, < 2.2.24
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.6.4-150600.3.3.1
- (no CPE)range: < 2.7.7-1.1
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.6.4-150600.3.3.1
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.2.3-150400.3.12.1
Patches
Vulnerability mechanics
References
9- github.com/advisories/GHSA-v9qv-c7wm-wgmfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-35242ghsaADVISORY
- github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396nvdWEB
- github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467nvdWEB
- github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmfnvdWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MCghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHCghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/nvd
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/nvd
News mentions
0No linked articles in our index yet.