Problem/Motivation

Discussed this with @longwave who discussed it with @greggles, both from the Security Team, and this CVE was found suitable to be handled in public.

Steps to reproduce

$ composer audit
Found 1 security vulnerability advisory affecting 1 package:
+-------------------+-------------------------------------------------------------------------------+
| Package           | composer/composer                                                             |
| CVE               | CVE-2023-43655                                                                |
| Title             | Composer Remote Code Execution vulnerability via web-accessible composer.phar |
| URL               | https://github.com/advisories/GHSA-jm6m-4632-36hf                             |
| Affected versions | >=2.3.0,<2.6.4|>=2.0.0,<2.2.22|<1.10.27                                       |
| Reported at       | 2023-09-29T20:39:21+00:00                                                     |
+-------------------+-------------------------------------------------------------------------------+

Proposed resolution

Update composer/composer to 2.6.4 and bump the version in composer.json to this one.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

CommentFileSizeAuthor
#6 3391991-10.1.x-5.patch6.33 KBspokje
#2 CVE-2023-43655.patch6.33 KBspokje

Comments

Spokje created an issue. See original summary.

spokje’s picture

spokje
Primary language Dutch
commented
StatusFileSize
new CVE-2023-43655.patch6.33 KB 
$ composer-lock-diff --no-links
+-------------------+-------+-------+
| Dev Changes       | From  | To    |
+-------------------+-------+-------+
| composer/composer | 2.5.7 | 2.6.4 |
+-------------------+-------+-------+
spokje’s picture

spokje
Primary language Dutch
commented
Title: Security update composer/composer () » Security update composer/composer (CVE-2023-43655)
Issue summary: View changes
spokje’s picture

spokje
Primary language Dutch
commented
Issue summary: View changes
spokje’s picture

spokje
Primary language Dutch
commented
Version: 11.x-dev » 10.1.x-dev
spokje’s picture

spokje
Primary language Dutch
commented
StatusFileSize
new 3391991-10.1.x-5.patch6.33 KB 
$ composer-lock-diff --no-links
+-------------------+-------+-------+
| Dev Changes       | From  | To    |
+-------------------+-------+-------+
| composer/composer | 2.5.7 | 2.6.4 |
+-------------------+-------+-------+
spokje’s picture

spokje
Primary language Dutch
commented
Issue summary: View changes
Status: Active » Needs review
longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Status: Needs review » Reviewed & tested by the community

Thank you for spotting this and providing the patches.

catch credited greggles.

catch’s picture

catch
he/him
Primary language English
commented
catch’s picture

catch
he/him
Primary language English
commented
Version: 10.1.x-dev » 10.0.x-dev
Status: Reviewed & tested by the community » Patch (to be ported)

Committed/pushed to 11.x and 10.1.x, thanks!

Do we also want to backport this to 10.0.x and 9.5.x? Moving to 10.0.x in case the answer is yes.

  • catch committed 325b3611 on 10.1.x 
    Issue #3391991 by Spokje, longwave, greggles: Security update composer/...

  • catch committed 6a023838 on 11.x 
    Issue #3391991 by Spokje, longwave, greggles: Security update composer/...
spokje’s picture

spokje
Primary language Dutch
commented

Do we also want to backport this to 10.0.x and 9.5.x?

Unsure, we didn't backport JavaScript yarn-dependencies with similar dev-dependency only CVEs below 10.1.x.

spokje’s picture

spokje
Primary language Dutch
commented
Status: Patch (to be ported) » Fixed
Related issues: +#3400841: Update Symfony to v6.3.8 / v4.4.51

Let's do the porting down in #3400841: Update Symfony to v6.3.8 / v4.4.51

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.