GitHub Advisoryadvisory · Packagist

GHSA-725m-w832-q973 Composer allows cache poisoning from other projects built on the same host

HIGH Published 2023-09-21 Modified 2023-09-29 Official page ↗
Aliases
CVE-2015-8371
Ecosystem
Packagist
Packages
composer/composer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-345
Reviewed
2023-09-21

Affected packages

• Packagist composer/composer: < 1.0.0 → fixed in 1.0.0

Description

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus can be found by an attacker). Versions through 1.0.0-alpha11 are affected, and 1.0.0 is unaffected.

Related

Alias · CVE (1)

  • CVE-2015-8371 Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References