CVE-2023-43655

HIGH EPSS 68.7%
Published Sep 29, 20232y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Sep 29, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
68.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-74

Affected Products 6

VendorProductVersionRange
getcomposercomposer* <1.10.27
getcomposercomposer*≥2.0.0  –  <2.2.21
getcomposercomposer*≥2.3.0  –  <2.6.4
debiandebian_linux10.0any
fedoraprojectfedora37any
fedoraprojectfedora38any

References 8

  • github.com https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d
    Patch
  • github.com https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c
    Patch
  • github.com https://github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9c
    Patch
  • github.com https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf
    Vendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/03/msg00030.html
    Mailing List
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG/
    Mailing ListThird Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE/
    Mailing ListThird Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2/
    Mailing ListThird Party Advisory

Remediation

  • github.com https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d
    Patch
  • github.com https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c
    Patch
  • github.com https://github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9c
    Patch