Hi,

The following vulnerability was published for composer.

CVE-2024-24821[0]:
| Composer is a dependency Manager for the PHP language. In affected
| versions several files within the local working directory are
| included during the invocation of Composer and in the context of the
| executing user. As such, under certain conditions arbitrary code
| execution may lead to local privilege escalation, provide lateral
| user movement or malicious code execution when Composer is invoked
| within a directory with tampered files. All Composer CLI commands
| are affected, including composer.phar's self-update. The following
| scenarios are of high risk: Composer being run with sudo, Pipelines
| which may execute Composer on untrusted projects, Shared
| environments with developers who run Composer individually on the
| same project. This vulnerability has been addressed in versions
| 2.7.0 and 2.2.23. It is advised that the patched versions are
| applied at the earliest convenience. Where not possible, the
| following should be addressed: Remove all sudo composer privileges
| for all users to mitigate root privilege escalation, and avoid
| running Composer within an untrusted directory, or if needed, verify
| that the contents of `vendor/composer/InstalledVersions.php` and
| `vendor/composer/installed.php` do not include untrusted code.  A
| reset can also be done on these files by the following:```sh rm
| vendor/composer/installed.php vendor/composer/InstalledVersions.php
| composer install --no-scripts --no-plugins ```


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-24821
https://www.cve.org/CVERecord?id=CVE-2024-24821
[1] https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h
[2] https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
composer, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1063603@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
David Prévot <taffit@debian.org> (supplier of updated composer package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 10 Feb 2024 11:18:19 +0100
Source: composer
Architecture: source
Version: 2.7.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Closes: 1061291 1063603
Changes:
 composer (2.7.1-1) unstable; urgency=medium
 .
   [ Jordi Boggiano ]
   * Merge pull request from GHSA-7c6p-848j-wh5h [CVE-2024-24821]
     (Closes: #1063603)
   * Release 2.7.1
 .
   [ David Prévot ]
   * Extend recommended packages list (Closes: #1061291)
Checksums-Sha1:
 2bb260346e20febbb761adf104fbe8bad497b8c7 2319 composer_2.7.1-1.dsc
 2ca791fcbda58871f8c99993f2067c5aff50a99f 656568 composer_2.7.1.orig.tar.xz
 900c8ce598b05a97079154f7b074f72429917a75 14828 composer_2.7.1-1.debian.tar.xz
 2a086c71a8aee3b24e6fe14d40f9d1e52980dcd4 9780 composer_2.7.1-1_amd64.buildinfo
Checksums-Sha256:
 23efd15fbe114f027d680cd033414d8457828e65b01d369a8d73aa46489493a9 2319 composer_2.7.1-1.dsc
 f5b6f31279976d5f7a7a94549919fdeb5ae93441f301106c2e00863a554401f3 656568 composer_2.7.1.orig.tar.xz
 823b8a26ffcc9ce8e3d93eae611e1843ad0529280e50d53d0b526b76a29fb4f9 14828 composer_2.7.1-1.debian.tar.xz
 56ca7728c4bd037b739041d6d58fc5eb859a5660ce9ce67b93229de06a136aae 9780 composer_2.7.1-1_amd64.buildinfo
Files:
 b55f58eee9d4b011dadc6735bc1f9345 2319 php optional composer_2.7.1-1.dsc
 84d2ce883c00f0cd5f122087d960dde5 656568 php optional composer_2.7.1.orig.tar.xz
 002420de756501167af182c8e3c91479 14828 php optional composer_2.7.1-1.debian.tar.xz
 9f429bf5517dfd2795d97d28becc56f5 9780 php optional composer_2.7.1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQFGBAEBCAAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmXHVNMSHHRhZmZpdEBk
ZWJpYW4ub3JnAAoJEAWMHPlE9r08R/wH/0TeDE8xTEtQngn7jpDB5zAi93JvoKCb
F1QPZQsjMWOSuOsS4S9XYaW5ppXuMrxFlmzJC9jXgILzwtiMK6tJzZuT9ttdWGu6
ZicnPG7DAuEhgw8Id3QEZBKpnf7h6Gw2yl3fvy5ZRI35aKnrJuAk/5LFSCJxeBQK
chsZpjUuzW7CwpWYllK7tQsUl2Swsd1jnF1wzhKbGTqK6QJtoDCwrNc/lVhDwYet
zhrIwA2GOfYYXCwUsxFVexkuW9fIhcEKltFhDXLxKqigNUa4+E7+70LMa+9ipadZ
t3nnIHJSJ1UUoWiHV5FGdFG2nTTHrvKy3RWmyv4a2eZ/LWCs0b3Wnyk=
=7Ky8
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
composer, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1063603@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
David Prévot <taffit@debian.org> (supplier of updated composer package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 13 Feb 2024 16:09:38 +0100
Source: composer
Architecture: source
Version: 2.5.5-1+deb12u1
Distribution: bookworm-security
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Closes: 1063603
Changes:
 composer (2.5.5-1+deb12u1) bookworm-security; urgency=medium
 .
   * Track debian/bookworm
   * Merge pull request from GHSA-7c6p-848j-wh5h [CVE-2024-24821]
     (Closes: #1063603)
   * Force system dependencies loading
Checksums-Sha1:
 f012ca8e256569d786c190bbf5c1b89a125402da 2391 composer_2.5.5-1+deb12u1.dsc
 e2d5b65f92956358abbfc07df002aa9d685097ef 634104 composer_2.5.5.orig.tar.xz
 c51250e2f434e302073739751f845466f7a3526c 18356 composer_2.5.5-1+deb12u1.debian.tar.xz
 63486043b9013a8991d56e43bcc356d5e7c8b39e 9727 composer_2.5.5-1+deb12u1_amd64.buildinfo
Checksums-Sha256:
 b253627020d663eff991b4d083dddf078da586e5cc66b1f4f0c6f43ff83fb2bb 2391 composer_2.5.5-1+deb12u1.dsc
 9d24f477e5a3c1c2ab12c1cf734a0d66d4572740d9edad44e462c5dc60983bce 634104 composer_2.5.5.orig.tar.xz
 f781e2e4cbcb2545860ab621cb1462c367fd8c3642bcd29345784f8f117aa3c0 18356 composer_2.5.5-1+deb12u1.debian.tar.xz
 efe0d78db671720c3f5277d135ff71f3c3b4302b5cce6909491280b965a8ab88 9727 composer_2.5.5-1+deb12u1_amd64.buildinfo
Files:
 f40ae2fddfbdd7dffbde447d481270d1 2391 php optional composer_2.5.5-1+deb12u1.dsc
 97b67f831115179d0fc8bacc64942951 634104 php optional composer_2.5.5.orig.tar.xz
 2029cba8c58804c55714c5179d495b75 18356 php optional composer_2.5.5-1+deb12u1.debian.tar.xz
 c2608488dd92506ae4245d4e790a2891 9727 php optional composer_2.5.5-1+deb12u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQFGBAEBCAAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmXYmpoSHHRhZmZpdEBk
ZWJpYW4ub3JnAAoJEAWMHPlE9r08GSAH/3CxYeGnxV8IDCuWhf9JJf2KehbZnS+L
OBZkEJCR0efylTR1tk++eQHi7udaJoEw2vm7AznqtcYp3Iv9wJP4fdvCfXOluBvU
br8Lc76PhyS4edGEF7+fk2H1EQ4OvElT8aeBSNnruQeRyBcoHcxx7jtZzQqHxfoG
mQ+3VAc7i5hJtSsBCbjSWX5XoR5xAdo2tNVK4aqfJ1D0jmElYRqNyeGuhSamikml
esIMhYWgqN7I5yz706xsfLh2oVz92wzorgVbIJKfGm1Sp2dT3n14bYxEx7n9eMGe
g5fw0YLJZPwSEJpyWgUtL3u1ngzUQicGbXw2qL6UpI6QSckeRk5V9Qs=
=f9SA
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
composer, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1063603@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
David Prévot <taffit@debian.org> (supplier of updated composer package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 18 Feb 2024 09:05:37 +0100
Source: composer
Architecture: source
Version: 2.0.9-2+deb11u2
Distribution: bullseye
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Closes: 1063603
Changes:
 composer (2.0.9-2+deb11u2) bullseye; urgency=medium
 .
   [ David Prévot ]
   * Force system dependencies loading
   * Import Pcre
 .
   [ Bastien Roucariès ]
   * Merge pull request from GHSA-7c6p-848j-wh5h [CVE-2024-24821]
     (Closes: #1063603)
Checksums-Sha1:
 2979fca50d1d9799d7ae6548c6836210cd686e71 2103 composer_2.0.9-2+deb11u2.dsc
 e8512695578a43d0a718b0ee14fd63cf6cccbcdc 803188 composer_2.0.9.orig.tar.xz
 21d2219c080a851d84c14a3de3aefbbea787931b 29776 composer_2.0.9-2+deb11u2.debian.tar.xz
 9213d670b570e5a5c5c964e3e710cf0599e435d5 9846 composer_2.0.9-2+deb11u2_amd64.buildinfo
Checksums-Sha256:
 7252dcba4f933cbc83814686711b1791ba685eb0c2b4c0b22474f3b85dcfbb20 2103 composer_2.0.9-2+deb11u2.dsc
 8868baee01986b93e2fc88dcd3989af16e228fcc4028561aacfbf5b778eb2216 803188 composer_2.0.9.orig.tar.xz
 4e5b288820015c37f61aaebd7f54abcf14188104b37c10c5e825cb7eced6d7da 29776 composer_2.0.9-2+deb11u2.debian.tar.xz
 0741e6d8f18ca3bb1f02f87b9d7adc1360594447fc66d39da73f4cba8248774e 9846 composer_2.0.9-2+deb11u2_amd64.buildinfo
Files:
 94b6d2b749469d140e35ce93c2bce921 2103 php optional composer_2.0.9-2+deb11u2.dsc
 828a4c4322fb8e384d35743ddc52be6b 803188 php optional composer_2.0.9.orig.tar.xz
 ef21ec97a6de5b51e2450d51cbc0801a 29776 php optional composer_2.0.9-2+deb11u2.debian.tar.xz
 86fb71921ff07c5994db947c04ca120e 9846 php optional composer_2.0.9-2+deb11u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQFGBAEBCAAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmXYmpkSHHRhZmZpdEBk
ZWJpYW4ub3JnAAoJEAWMHPlE9r08r5kH+wdPPwlU73mUPXTfHv0sGIrD+Y61aAwF
uy1nt1nRWa/4og9vWbb6Yi82iHJKRgA6eoWKdouhynTuvVbXBAOTTFhgSNKUuws/
vAfunxh8Laobo0wSNzWCFJ6lIqoEN4pf4QFiGiA9olYgNk8JV2LNDcs/0NJF3Jpv
TJpWyOdIkpsCl2TDpDuSSDgjyZOoIKC1HbrjMcKbCsCXVmUY9TCGbg9pizTds6hp
DEfjVTfZDKciOOr991VTX5bZBO1K5hYjKgSlqcc6cNlZ4QITH/bChAyf68dokuoU
xYC8DuU8aCdxf1dk62mIFjugGYOOXgxD3OTZNp8iil4t+s6OOch0sqM=
=l4fg
-----END PGP SIGNATURE-----