跳转到帖子

SUSE: CVE-2024-35242: SUSE Linux Security Advisory

recommended_posts

发布于
  • Members

SUSE: CVE-2024-35242: SUSE Linux Security Advisory

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
06/10/2024
Created
06/21/2024
Added
06/21/2024
Modified
06/21/2024

Description

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

Solution(s)

  • suse-upgrade-php-composer2

References

  • https://attackerkb.com/topics/cve-2024-35242
  • CVE - 2024-35242
  • 查看数 701
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…