Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Composer is an open source dependency manager for the PHP language. In affected versions windows users     running Composer to install untrusted dependencies are subject to command injection and should upgrade     their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer     versions 1.10.23 and 2.1.9. There are no workarounds for this issue. (CVE-2021-41116)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0132-1 advisory.

  - Composer is an open source dependency manager for the PHP language. In affected versions windows users     running Composer to install untrusted dependencies are subject to command injection and should upgrade     their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer     versions 1.10.23 and 2.1.9. There are no workarounds for this issue. (CVE-2021-41116)

  - Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call     `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or     `$identifier` argument. This leads to a vulnerability on packagist.org for example where the     composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the     `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does     not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it     does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our     knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private     Packagist within a day of the vulnerability report. (CVE-2022-24828)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.21.0 and is therefore affected by multiple vulnerabilities:

    - A command injection vulnerability exists in Composer. An unauthenticated, remote attacker can exploit this       to execute arbitrary commands by installing untrusted dependencies. (CVE-2021-41116)     
    - A code injection vulnerability exists in Composer. An unauthenticated, remote attacker can exploit this       to execute arbitrary commands by controlling the $file or $identifier argument. (CVE-2022-24828)     
    - Read/write beyond bounds - Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to       overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version       2.4.52 and prior versions. (CVE-2022-23943)   Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Severity
256420	Linux Distros Unpatched Vulnerability : CVE-2021-41116	Nessus	Misc.	critical
160972	openSUSE 15 Security Update : php-composer (openSUSE-SU-2022:0132-1)	Nessus	SuSE Local Security Checks	critical
160883	Tenable SecurityCenter < 5.21.0 Multiple Vulnerabilities (TNS-2022-09)	Nessus	Misc.	critical

Detections

Analytics

CVE-2021-41116

critical

Tenable Plugins

critical

critical

critical