SZB-1304fcf247
Composer patches two vulnerabilities: path traversal and token leak
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Composer
- Product
- Composer
- First seen
Summary
A SecurityOnline post reports that Composer, the PHP dependency manager, has two vulnerabilities: a path traversal flaw (GHSA-c968-33g3-wh7p) and a token leak (GHSA-fm2w-xgf2-f9fh). The fixed versions are 2.11.0 and 2.2.31.
If you use Composer
Upgrade Composer to 2.11.0 or 2.2.31
Run composer --version to confirm the installed release
Rotate any Packagist or repository tokens that may have been exposed
What the sources say 1
· Mastodon: “Upgrade to Composer 2.11.0 or 2.2.31 to fix two Composer vulnerabilities: path traversal GHSA-c968-33g3-wh7p and token leak GHSA-fm2w-xgf2-f9fh.” Source