Detections
Analytics
Alpine: multiple composer packages: security update to 2.7.7-r0
high Tenable Self-Hosted Container Security Plugin ID 408451
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the
`status`, `reinstall` and `remove` commands with packages installed from source via git containing
specially crafted branch names in the repository can be used to execute code. Patches for this issue are
available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing
dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.
(CVE-2024-35241)
- Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the
`composer install` command running inside a git/hg repository which has specially crafted branch names can
lead to command injection. This requires cloning untrusted repositories. Patches are available in version
2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised
repositories. (CVE-2024-35242)
See Also
Plugin Details
Severity: High
ID: 408451
Version: Revision 1.12
Type: Local
Published: 6/11/2024
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.85
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-35242
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 6/10/2024
Reference Information
CVE: CVE-2024-35241, CVE-2024-35242