PT-2023-9221 · Composer +6 · Composer +6

Thomas-Chauchefoin-Sonarsource

·

Published

2023-09-29

·

Updated

2025-06-30

·

CVE-2023-43655

Report an issue
CVSS v2.0
9.0
VectorAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions:

Composer versions prior to 1.10.27

Composer versions prior to 2.2.22

Composer versions prior to 2.6.4

Description:

The issue is related to the Composer dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register argc argv` enabled in php.ini.

Recommendations:

For versions prior to 1.10.27, upgrade to version 1.10.27 or later.

For versions prior to 2.2.22, upgrade to version 2.2.22 or later.

For versions prior to 2.6.4, upgrade to version 2.6.4 or later.

As a temporary workaround, consider disabling the `register argc argv` setting in php.ini to minimize the risk of exploitation.

Avoid publishing composer.phar to the web as this is not best practice.

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2024-04879
BIT-COMPOSER-2023-43655
CVE-2023-43655
DLA-3777-1
GHSA-JM6M-4632-36HF
OPENSUSE-SU-2023_4041-1
OPENSUSE-SU-2024:13290-1
SUSE-SU-2023:4041-1
SUSE-SU-2023_4041-1
USN-7603-1

Affected Products

Astra Linux
Composer
Debian
Linuxmint
Red Os
Suse
Ubuntu