CVE-2021-41116 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2021-41116 Interim 1 10 2023-09-06T23:40:21Z current 2021-10-08T01:03:16Z 2023-09-06T23:40:21Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2021-41116 Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GK3MSPNLXNEQ4P7QF5ZJB6IK4W6YAUKM/ E-Mail link for openSUSE-SU-2022:0132-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Package Hub 15 SP3 openSUSE Leap 15.3 openSUSE Tumbleweed php-composer-1.10.25-1.1 php-composer-1.10.26-bp153.2.6.1 php-composer2-2.1.12-1.1 php-composer-1.10.26-bp153.2.6.1 as a component of SUSE Package Hub 15 SP3 php-composer-1.10.26-bp153.2.6.1 as a component of openSUSE Leap 15.3 php-composer-1.10.25-1.1 as a component of openSUSE Tumbleweed php-composer2-2.1.12-1.1 as a component of openSUSE Tumbleweed Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue. CVE-2021-41116 SUSE Package Hub 15 SP3:php-composer-1.10.26-bp153.2.6.1 openSUSE Leap 15.3:php-composer-1.10.26-bp153.2.6.1 openSUSE Tumbleweed:php-composer-1.10.25-1.1 openSUSE Tumbleweed:php-composer2-2.1.12-1.1 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H