Amazon Linux 2023 Security Advisory: ALAS2023-2024-650
Advisory Released Date: 2024-07-18
Advisory Updated Date: 2024-07-18
Severity:
Important
Issue Overview:
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting. (CVE-2024-35241)
Affected Packages:
composer
Issue Correction:
Run dnf update composer --releasever 2023.5.20240708 or dnf update --advisory ALAS2023-2024-650 --releasever 2023.5.20240708 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
noarch:
composer-2.5.8-2.amzn2023.0.3.noarch
src:
composer-2.5.8-2.amzn2023.0.3.src