Packagist/composer/composer CVE-2015-8371: high 8.8, EPSS 0.72%

Composer allows cache poisoning from other projects built on the same host

Action: Upgrade composer/composer to 1.0.0 or later.

composer require composer/composer:1.0.0

Affected

Fixed versions

Sources

• osv: GHSA-725m-w832-q973
• https://nvd.nist.gov/vuln/detail/CVE-2015-8371
• https://flyingmana.de/blog_en/2016/02/14/composer_cache_injection_vulnerability_cve_2015_8371.html
• https://github.com/FriendsOfPHP/security-advisories/blob/e26be423c5bcfdb38478d2f92d1f928c15afb561/composer/composer/CVE-2015-8371.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2015-8371.yaml
• https://github.com/composer/composer
• https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2015-8371.yml
• http://flyingmana.de/blog_en/2016/02/14/composer_cache_injection_vulnerability_cve_2015_8371.html

CVE-2015-8371 · published 2023-09-21T06:30:25Z · modified 2024-02-16T08:06:03.292718Z · JSON