Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is derived from the package name, the dist type, and certain other data from the package repository (which may simply be a commit hash, and thus can be found by an attacker). Versions through 1.0.0-alpha11 are affected, and 1.0.0 is unaffected.
References
| Link | Resource |
|---|---|
| https://flyingmana.de/blog_en/2016/02/14/composer_cache_injection_vulnerability_cve_2015_8371.html | Exploit Third Party Advisory |
| https://github.com/FriendsOfPHP/security-advisories/blob/e26be423c5bcfdb38478d2f92d1f928c15afb561/composer/composer/CVE-2015-8371.yaml | Third Party Advisory |
| https://github.com/composer/composer | Product |
| https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2015-8371.yml | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
29 Sep 2023, 04:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://flyingmana.de/blog_en/2016/02/14/composer_cache_injection_vulnerability_cve_2015_8371.html - Exploit, Third Party Advisory | |
| References | (MISC) https://github.com/composer/composer - Product | |
| References | (MISC) https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2015-8371.yml - Third Party Advisory | |
| References | (MISC) https://github.com/FriendsOfPHP/security-advisories/blob/e26be423c5bcfdb38478d2f92d1f928c15afb561/composer/composer/CVE-2015-8371.yaml - Third Party Advisory | |
| CPE | cpe:2.3:a:getcomposer:composer:1.0.0:alpha5:*:*:*:*:*:* cpe:2.3:a:getcomposer:composer:1.0.0:alpha1:*:*:*:*:*:* cpe:2.3:a:getcomposer:composer:1.0.0:alpha2:*:*:*:*:*:* cpe:2.3:a:getcomposer:composer:1.0.0:alpha11:*:*:*:*:*:* cpe:2.3:a:getcomposer:composer:1.0.0:alpha6:*:*:*:*:*:* cpe:2.3:a:getcomposer:composer:1.0.0:alpha4:*:*:*:*:*:* cpe:2.3:a:getcomposer:composer:1.0.0:alpha7:*:*:*:*:*:* cpe:2.3:a:getcomposer:composer:1.0.0:alpha9:*:*:*:*:*:* cpe:2.3:a:getcomposer:composer:1.0.0:alpha8:*:*:*:*:*:* cpe:2.3:a:getcomposer:composer:1.0.0:alpha3:*:*:*:*:*:* cpe:2.3:a:getcomposer:composer:1.0.0:alpha10:*:*:*:*:*:* |
|
| CWE | CWE-345 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Getcomposer
Getcomposer composer |
21 Sep 2023, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-21 06:15
Updated : 2023-12-10 15:14
NVD link : CVE-2015-8371
Mitre link : CVE-2015-8371
CVE.ORG link : CVE-2015-8371
JSON object : View
Products Affected
getcomposer
- composer
CWE
CWE-345
Insufficient Verification of Data Authenticity