FEDORA-2023-f3dedfef46 — security update for composer

stable

composer-2.6.5-1.fc38

FEDORA-2023-f3dedfef46 created by remi 11 months ago for Fedora 38

Version 2.6.5 - 2023-10-06

Fixed error when vendor dir contains broken symlinks (#11670)
Fixed composer.lock missing from Composer's zip archives (#11674)
Fixed AutoloadGenerator::dump() non-BC signature change in 2.6.4 (cb363b0e8)

Version 2.6.4 - 2023-09-29

Security: Fixed possible remote code execution vulnerability if composer.phar is publicly accessible, executable as PHP, and register_argc_argv is enabled in php.ini (GHSA-jm6m-4632-36hf / CVE-2023-43655)
Fixed json output of abandoned packages in audit command (#11647)
Performance improvement in pool optimization step (#11638)
Performance improvement in show -a <packagename> (#11659)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2023-f3dedfef46

This update has been submitted for testing by remi.

11 months ago

This update's test gating status has been changed to 'ignored'.

11 months ago

This update has obsoleted composer-2.6.4-1.fc38, and has inherited its bugs and notes.

11 months ago

This update has been pushed to testing.

11 months ago

This update has been submitted for stable by bodhi.

11 months ago

This update has been pushed to stable.

11 months ago

Please login to add feedback.

Metadata

Type

security

Severity

low

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

composer-2.6.5-1.fc38

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

11 months ago

in testing

11 months ago

in stable

11 months ago

approved

11 months ago

BZ#2241496 CVE-2023-43655 composer: Remote Code Execution via web-accessible composer.phar

BZ#2241498 CVE-2023-43655 composer: Remote Code Execution via web-accessible composer.phar [fedora-all]

composer-2.6.5-1.fc38

Automated Test Results

ignored