CVE catalog

CVE-2024-35241

Composer vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.05% · Oct 25, 2026

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancomposersid2.10.3-1fixed
Debiancomposerforky2.10.3-1fixed
Debiancomposertrixie2.8.8-1+deb13u3fixed
Debiancomposerbookworm2.5.5-1+deb12u5fixed
Debiancomposerbookworm-security2.5.5-1+deb12u2fixed
Ubuntucomposernoble2.7.1-2ubuntu0.1~esm1fixed
Susephp-composer2linux enterprise module for web and scripting 15 sp72.6.4-150600.3.12.1fixed
Susephp-composer2linux enterprise server 15 sp6-ltss2.6.4-150600.3.12.1fixed
Susephp-composer2linux enterprise server for sap applications 15 sp62.6.4-150600.3.12.1fixed
Ubuntucomposerpro2.5.8-1vulnerable
Ubuntucomposerpro2.6.5-1vulnerable
Ubuntucomposerpro2.6.6-1vulnerable
Ubuntucomposerpro2.7.1-2vulnerable
Ubuntucomposerpro2.7.1-2ubuntu0.1~esm1fixed
Opensusephp-composer2tumbleweed2.7.7-1.1fixed
Susephp-composer2linux enterprise module for web and scripting 15 sp62.6.4-150600.3.3.1fixed
Opensusephp-composer2leap 15.62.6.4-150600.3.3.1fixed
Susephp-composer2linux enterprise module for web and scripting 15 sp52.2.3-150400.3.12.1fixed
Susephp-composer2linux enterprise high performance computing 15 sp4-espos2.2.3-150400.3.12.1fixed
Susephp-composer2linux enterprise high performance computing 15 sp4-ltss2.2.3-150400.3.12.1fixed
Susephp-composer2linux enterprise server 15 sp4-ltss2.2.3-150400.3.12.1fixed
Susephp-composer2linux enterprise server for sap applications 15 sp42.2.3-150400.3.12.1fixed
Susephp-composer2manager server 4.32.2.3-150400.3.12.1fixed
Opensusephp-composer2leap 15.52.2.3-150400.3.12.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancomposersourcesid2.7.7-1not yet assignedNot reported[1073125]
Debiancomposersourceforky2.7.7-1not yet assignedNot reported[1073125]
Debiancomposersourcetrixie2.7.7-1not yet assignedNot reported[1073125]
Debiancomposersourcebookworm2.5.5-1+deb12u2not yet assignedNot reported[1073125]
Ubuntucomposerdebnoble2.7.1-2ubuntu0.1~esm1Not reportedNot reportedNot reported
Susephp-composer2rpmlinux enterprise module for web and scripting 15 sp72.6.4-150600.3.12.1Not reportedSUSE-SU-2026:3105-1Not reported
Susephp-composer2rpmlinux enterprise server 15 sp6-ltss2.6.4-150600.3.12.1Not reportedSUSE-SU-2026:3105-1Not reported
Susephp-composer2rpmlinux enterprise server for sap applications 15 sp62.6.4-150600.3.12.1Not reportedSUSE-SU-2026:3105-1Not reported
Ubuntucomposerdebpro2.7.1-2ubuntu0.1~esm1Not reportedUBUNTU-CVE-2024-35241Not reported
Opensusephp-composer2rpmtumbleweed2.7.7-1.1Not reportedOPENSUSE-SU-2024:14040-1Not reported
Susephp-composer2rpmlinux enterprise module for web and scripting 15 sp62.6.4-150600.3.3.1Not reportedSUSE-SU-2024:2107-1Not reported
Opensusephp-composer2rpmleap 15.62.6.4-150600.3.3.1Not reportedSUSE-SU-2024:2107-1Not reported
Susephp-composer2rpmlinux enterprise module for web and scripting 15 sp52.2.3-150400.3.12.1Not reportedSUSE-SU-2024:2106-1Not reported
Susephp-composer2rpmlinux enterprise high performance computing 15 sp4-espos2.2.3-150400.3.12.1Not reportedSUSE-SU-2024:2106-1Not reported
Susephp-composer2rpmlinux enterprise high performance computing 15 sp4-ltss2.2.3-150400.3.12.1Not reportedSUSE-SU-2024:2106-1Not reported
Susephp-composer2rpmlinux enterprise server 15 sp4-ltss2.2.3-150400.3.12.1Not reportedSUSE-SU-2024:2106-1Not reported
Susephp-composer2rpmlinux enterprise server for sap applications 15 sp42.2.3-150400.3.12.1Not reportedSUSE-SU-2024:2106-1Not reported
Susephp-composer2rpmmanager server 4.32.2.3-150400.3.12.1Not reportedSUSE-SU-2024:2106-1Not reported
Opensusephp-composer2rpmleap 15.52.2.3-150400.3.12.1Not reportedSUSE-SU-2024:2106-1Not reported

[Debian bug #1073125]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [composer]Fixed
    Details (4)

    • 2.5.5-1+deb12u5 · all · bookworm

      Fixed · Fixed: 2.5.5-1+deb12u2

      usn · composer · debian · bookworm; usn · composer · debian · 12

    • 2.5.5-1+deb12u5 · all · bookworm

      Fixed · Fixed: 2.5.5-1+deb12u2

      usn · composer · debian · bookworm; usn · composer · debian · 12

    • 2.5.5-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.5.5-1+deb12u2

      usn · composer · debian · bookworm; usn · composer · debian · 12

    • 2.5.5-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.5.5-1+deb12u2

      usn · composer · debian · bookworm; usn · composer · debian · 12

[Debian 13 (Trixie)]

  • [composer]Fixed
    Details (2)

    • 2.8.8-1+deb13u3 · all · trixie

      Fixed · Fixed: 2.7.7-1

      usn · composer · debian · 13

    • 2.8.8-1+deb13u3 · all · trixie

      Fixed · Fixed: 2.7.7-1

      usn · composer · debian · 13

[openSUSE Tumbleweed]

  • [php-composer2]Fixed

    Source package: [php-composer2]

    Details (1)

    • 2.10.3-1.1 · noarch · tumbleweed

      Fixed · Fixed: 2.7.7-1.1

      usn · php-composer2 · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]