FEDORA-2023-275c12e496 — security update for composer

stable

composer-2.6.5-1.fc37

FEDORA-2023-275c12e496 created by remi a year ago for Fedora 37

Version 2.6.5 - 2023-10-06

Fixed error when vendor dir contains broken symlinks (#11670)
Fixed composer.lock missing from Composer's zip archives (#11674)
Fixed AutoloadGenerator::dump() non-BC signature change in 2.6.4 (cb363b0e8)

Version 2.6.4 - 2023-09-29

Security: Fixed possible remote code execution vulnerability if composer.phar is publicly accessible, executable as PHP, and register_argc_argv is enabled in php.ini (GHSA-jm6m-4632-36hf / CVE-2023-43655)
Fixed json output of abandoned packages in audit command (#11647)
Performance improvement in pool optimization step (#11638)
Performance improvement in show -a <packagename> (#11659)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2023-275c12e496

This update has been submitted for testing by remi.

a year ago

This update's test gating status has been changed to 'ignored'.

a year ago

This update has obsoleted composer-2.6.4-1.fc37, and has inherited its bugs and notes.

a year ago

This update has been pushed to testing.

a year ago

This update has been submitted for stable by bodhi.

a year ago

This update has been pushed to stable.

a year ago

Please login to add feedback.

Metadata

Type

security

Severity

low

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

composer-2.6.5-1.fc37

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

a year ago

in testing

a year ago

in stable

a year ago

approved

a year ago

BZ#2241496 CVE-2023-43655 composer: Remote Code Execution via web-accessible composer.phar

BZ#2241498 CVE-2023-43655 composer: Remote Code Execution via web-accessible composer.phar [fedora-all]

composer-2.6.5-1.fc37

Automated Test Results

ignored