Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/499653?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/499653?format=api", "purl": "pkg:composer/composer/composer@1.10.17", "type": "composer", "namespace": "composer", "name": "composer", "version": "1.10.17", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "1.10.28", "latest_non_vulnerable_version": "2.10.0-RC1", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/197573?format=api", "vulnerability_id": "VCID-4a1g-pkej-vkgh", "summary": "arbitrary command execution", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41116", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00969", "scoring_system": "epss", "scoring_elements": "0.77114", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00969", "scoring_system": "epss", "scoring_elements": "0.77031", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00969", "scoring_system": "epss", "scoring_elements": "0.77102", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41116" }, { "reference_url": "https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa" }, { "reference_url": "https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-41116.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-41116.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41116", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41116" }, { "reference_url": "https://www.sonarsource.com/blog/securing-developer-tools-package-managers", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.sonarsource.com/blog/securing-developer-tools-package-managers" }, { "reference_url": "https://security.archlinux.org/AVG-2446", "reference_id": "AVG-2446", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2446" }, { "reference_url": "https://github.com/advisories/GHSA-frqg-7g38-6gcf", "reference_id": "GHSA-frqg-7g38-6gcf", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-frqg-7g38-6gcf" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/382242?format=api", "purl": "pkg:composer/composer/composer@1.10.23", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" }, { "vulnerability": "VCID-h6a3-5vxq-pfav" }, { "vulnerability": "VCID-jfte-fyut-13cr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@1.10.23" }, { "url": "http://public2.vulnerablecode.io/api/packages/518010?format=api", "purl": "pkg:composer/composer/composer@2.0.0-RC1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.0.0-RC1" }, { "url": "http://public2.vulnerablecode.io/api/packages/382243?format=api", "purl": "pkg:composer/composer/composer@2.1.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-58ua-fyne-u7fj" }, { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" }, { "vulnerability": "VCID-cp3v-jxnh-tug6" }, { "vulnerability": "VCID-h6a3-5vxq-pfav" }, { "vulnerability": "VCID-jfte-fyut-13cr" }, { "vulnerability": "VCID-msjj-w941-33aj" }, { "vulnerability": "VCID-nfz6-bse5-xyen" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.1.9" } ], "aliases": [ "CVE-2021-41116", "GHSA-frqg-7g38-6gcf" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4a1g-pkej-vkgh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/28522?format=api", "vulnerability_id": "VCID-a5f8-n9d2-eqff", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40176.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40176.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40176", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05593", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.05614", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00019", "scoring_system": "epss", "scoring_elements": "0.0562", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40176" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40176", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40176" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-40176.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-40176.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40176", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40176" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458828", "reference_id": "2458828", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458828" }, { "reference_url": "https://github.com/composer/composer/releases/tag/2.9.6", "reference_id": "2.9.6", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-16T14:16:01Z/" } ], "url": "https://github.com/composer/composer/releases/tag/2.9.6" }, { "reference_url": "https://github.com/advisories/GHSA-wg36-wvj6-r67p", "reference_id": "GHSA-wg36-wvj6-r67p", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wg36-wvj6-r67p" }, { "reference_url": "https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p", "reference_id": "GHSA-wg36-wvj6-r67p", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-16T14:16:01Z/" } ], "url": "https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:8165", "reference_id": "RHSA-2026:8165", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:8165" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/374277?format=api", "purl": "pkg:composer/composer/composer@2.2.27", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.2.27" }, { "url": "http://public2.vulnerablecode.io/api/packages/656437?format=api", "purl": "pkg:composer/composer/composer@2.3.0-RC1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.3.0-RC1" }, { "url": "http://public2.vulnerablecode.io/api/packages/374276?format=api", "purl": "pkg:composer/composer/composer@2.9.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.9.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/1006472?format=api", "purl": "pkg:composer/composer/composer@2.10.0-RC1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.10.0-RC1" } ], "aliases": [ "CVE-2026-40176", "GHSA-wg36-wvj6-r67p" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a5f8-n9d2-eqff" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/28541?format=api", "vulnerability_id": "VCID-byja-84wd-bbep", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40261.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40261.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40261", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00042", "scoring_system": "epss", "scoring_elements": "0.13004", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00042", "scoring_system": "epss", "scoring_elements": "0.13108", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00042", "scoring_system": "epss", "scoring_elements": "0.131", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40261" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40261", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40261" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-40261.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-40261.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40261", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40261" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458841", "reference_id": "2458841", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458841" }, { "reference_url": "https://github.com/composer/composer/releases/tag/2.9.6", "reference_id": "2.9.6", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-16T13:41:03Z/" } ], "url": "https://github.com/composer/composer/releases/tag/2.9.6" }, { "reference_url": "https://github.com/advisories/GHSA-gqw4-4w2p-838q", "reference_id": "GHSA-gqw4-4w2p-838q", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gqw4-4w2p-838q" }, { "reference_url": "https://github.com/composer/composer/security/advisories/GHSA-gqw4-4w2p-838q", "reference_id": "GHSA-gqw4-4w2p-838q", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-16T13:41:03Z/" } ], "url": "https://github.com/composer/composer/security/advisories/GHSA-gqw4-4w2p-838q" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:8165", "reference_id": "RHSA-2026:8165", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:8165" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/374277?format=api", "purl": "pkg:composer/composer/composer@2.2.27", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.2.27" }, { "url": "http://public2.vulnerablecode.io/api/packages/656437?format=api", "purl": "pkg:composer/composer/composer@2.3.0-RC1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.3.0-RC1" }, { "url": "http://public2.vulnerablecode.io/api/packages/374276?format=api", "purl": "pkg:composer/composer/composer@2.9.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.9.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/1006472?format=api", "purl": "pkg:composer/composer/composer@2.10.0-RC1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.10.0-RC1" } ], "aliases": [ "CVE-2026-40261", "GHSA-gqw4-4w2p-838q" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-byja-84wd-bbep" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15896?format=api", "vulnerability_id": "VCID-h6a3-5vxq-pfav", "summary": "", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-43655", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01533", "scoring_system": "epss", "scoring_elements": "0.8173", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.01533", "scoring_system": "epss", "scoring_elements": "0.81791", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.01533", "scoring_system": "epss", "scoring_elements": "0.818", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-43655" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43655", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43655" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43655", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43655" }, { "reference_url": "https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d", "reference_id": "4fce14795aba98e40b6c4f5047305aba17a6120d", "reference_type": "", "scores": [ { "value": "6.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-23T16:22:54Z/" } ], "url": "https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG/", "reference_id": "66H2WKFUO255T3BZTL72TNYJYH2XM5FG", "reference_type": "", "scores": [ { "value": "6.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-23T16:22:54Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2WKFUO255T3BZTL72TNYJYH2XM5FG/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE/", "reference_id": "7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE", "reference_type": "", "scores": [ { "value": "6.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-23T16:22:54Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7AWYAUZNH565NWPIKGEIYBWHYNM5JGAE/" }, { "reference_url": "https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c", "reference_id": "955a48e6319c8962e5cd421b07c00ab3c728968c", "reference_type": "", "scores": [ { "value": "6.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-23T16:22:54Z/" } ], "url": "https://github.com/composer/composer/commit/955a48e6319c8962e5cd421b07c00ab3c728968c" }, { "reference_url": "https://github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9c", "reference_id": "95e091c921037b7b6564942845e7b738f6b95c9c", "reference_type": "", "scores": [ { "value": "6.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-23T16:22:54Z/" } ], "url": "https://github.com/composer/composer/commit/95e091c921037b7b6564942845e7b738f6b95c9c" }, { "reference_url": "https://github.com/advisories/GHSA-jm6m-4632-36hf", "reference_id": "GHSA-jm6m-4632-36hf", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jm6m-4632-36hf" }, { "reference_url": "https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf", "reference_id": "GHSA-jm6m-4632-36hf", "reference_type": "", "scores": [ { "value": "6.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-23T16:22:54Z/" } ], "url": "https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf" }, { "reference_url": "https://security.gentoo.org/glsa/202508-06", "reference_id": "GLSA-202508-06", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202508-06" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2/", "reference_id": "KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2", "reference_type": "", "scores": [ { "value": "6.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-23T16:22:54Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFOPGPW2KS37O3KJWBRGTUWHTXCQXBS2/" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00030.html", "reference_id": "msg00030.html", "reference_type": "", "scores": [ { "value": "6.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-23T16:22:54Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00030.html" }, { "reference_url": "https://usn.ubuntu.com/7603-1/", "reference_id": "USN-7603-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7603-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/379650?format=api", "purl": "pkg:composer/composer/composer@1.10.27", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@1.10.27" }, { "url": "http://public2.vulnerablecode.io/api/packages/518010?format=api", "purl": "pkg:composer/composer/composer@2.0.0-RC1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.0.0-RC1" }, { "url": "http://public2.vulnerablecode.io/api/packages/379651?format=api", "purl": "pkg:composer/composer/composer@2.2.22", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-58ua-fyne-u7fj" }, { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" }, { "vulnerability": "VCID-cp3v-jxnh-tug6" }, { "vulnerability": "VCID-msjj-w941-33aj" }, { "vulnerability": "VCID-nfz6-bse5-xyen" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.2.22" }, { "url": "http://public2.vulnerablecode.io/api/packages/656437?format=api", "purl": "pkg:composer/composer/composer@2.3.0-RC1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.3.0-RC1" }, { "url": "http://public2.vulnerablecode.io/api/packages/379652?format=api", "purl": "pkg:composer/composer/composer@2.6.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-58ua-fyne-u7fj" }, { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" }, { "vulnerability": "VCID-cp3v-jxnh-tug6" }, { "vulnerability": "VCID-msjj-w941-33aj" }, { "vulnerability": "VCID-nfz6-bse5-xyen" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.6.4" } ], "aliases": [ "CVE-2023-43655", "GHSA-jm6m-4632-36hf" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-h6a3-5vxq-pfav" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11614?format=api", "vulnerability_id": "VCID-jfte-fyut-13cr", "summary": "", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-24828", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00162", "scoring_system": "epss", "scoring_elements": "0.36968", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00162", "scoring_system": "epss", "scoring_elements": "0.37173", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00162", "scoring_system": "epss", "scoring_elements": "0.37146", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-24828" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24828", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24828" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009960", "reference_id": "1009960", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009960" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24828", "reference_id": "CVE-2022-24828", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24828" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2022-24828.yaml", "reference_id": "CVE-2022-24828.YAML", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2022-24828.yaml" }, { "reference_url": "https://github.com/advisories/GHSA-x7cr-6qr6-2hh6", "reference_id": "GHSA-x7cr-6qr6-2hh6", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-x7cr-6qr6-2hh6" }, { "reference_url": "https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6", "reference_id": "GHSA-x7cr-6qr6-2hh6", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6" }, { "reference_url": "https://security.gentoo.org/glsa/202508-06", "reference_id": "GLSA-202508-06", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202508-06" }, { "reference_url": "https://usn.ubuntu.com/7603-1/", "reference_id": "USN-7603-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7603-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20228?format=api", "purl": "pkg:composer/composer/composer@1.10.26", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" }, { "vulnerability": "VCID-h6a3-5vxq-pfav" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@1.10.26" }, { "url": "http://public2.vulnerablecode.io/api/packages/20232?format=api", "purl": "pkg:composer/composer/composer@2.2.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-58ua-fyne-u7fj" }, { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" }, { "vulnerability": "VCID-cp3v-jxnh-tug6" }, { "vulnerability": "VCID-h6a3-5vxq-pfav" }, { "vulnerability": "VCID-msjj-w941-33aj" }, { "vulnerability": "VCID-nfz6-bse5-xyen" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.2.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/20230?format=api", "purl": "pkg:composer/composer/composer@2.3.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-58ua-fyne-u7fj" }, { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" }, { "vulnerability": "VCID-cp3v-jxnh-tug6" }, { "vulnerability": "VCID-h6a3-5vxq-pfav" }, { "vulnerability": "VCID-msjj-w941-33aj" }, { "vulnerability": "VCID-nfz6-bse5-xyen" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.3.5" } ], "aliases": [ "CVE-2022-24828", "GHSA-x7cr-6qr6-2hh6" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jfte-fyut-13cr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/197649?format=api", "vulnerability_id": "VCID-vvbj-3291-z7g7", "summary": "arbitrary code execution", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29472", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02585", "scoring_system": "epss", "scoring_elements": "0.85905", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.02585", "scoring_system": "epss", "scoring_elements": "0.85964", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.02585", "scoring_system": "epss", "scoring_elements": "0.85954", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29472" }, { "reference_url": "https://blog.sonarsource.com/php-supply-chain-attack-on-composer", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://blog.sonarsource.com/php-supply-chain-attack-on-composer" }, { "reference_url": "https://blog.sonarsource.com/php-supply-chain-attack-on-composer/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://blog.sonarsource.com/php-supply-chain-attack-on-composer/" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29472", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29472" }, { "reference_url": "https://getcomposer.org", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://getcomposer.org" }, { "reference_url": "https://getcomposer.org/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://getcomposer.org/" }, { "reference_url": "https://github.com/composer/composer/security/advisories/GHSA-h5h8-pc6h-jvvx", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/composer/composer/security/advisories/GHSA-h5h8-pc6h-jvvx" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-29472.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-29472.yaml" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00009.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00009.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAQUAMGO4Q4BLNZ2OH4CXQD7UK4IO2GE", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAQUAMGO4Q4BLNZ2OH4CXQD7UK4IO2GE" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAQUAMGO4Q4BLNZ2OH4CXQD7UK4IO2GE/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAQUAMGO4Q4BLNZ2OH4CXQD7UK4IO2GE/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KN3DMFH42BJW45VT6FYF2RXKC26D6VC2", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KN3DMFH42BJW45VT6FYF2RXKC26D6VC2" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KN3DMFH42BJW45VT6FYF2RXKC26D6VC2/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KN3DMFH42BJW45VT6FYF2RXKC26D6VC2/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29472", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29472" }, { "reference_url": "https://www.debian.org/security/2021/dsa-4907", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.debian.org/security/2021/dsa-4907" }, { "reference_url": "https://security.archlinux.org/AVG-1885", "reference_id": "AVG-1885", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1885" }, { "reference_url": "https://github.com/advisories/GHSA-h5h8-pc6h-jvvx", "reference_id": "GHSA-h5h8-pc6h-jvvx", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-h5h8-pc6h-jvvx" }, { "reference_url": "https://usn.ubuntu.com/USN-5220-1/", "reference_id": "USN-USN-5220-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/USN-5220-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/382305?format=api", "purl": "pkg:composer/composer/composer@1.10.22", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1g-pkej-vkgh" }, { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" }, { "vulnerability": "VCID-h6a3-5vxq-pfav" }, { "vulnerability": "VCID-jfte-fyut-13cr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@1.10.22" }, { "url": "http://public2.vulnerablecode.io/api/packages/382306?format=api", "purl": "pkg:composer/composer/composer@2.0.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4a1g-pkej-vkgh" }, { "vulnerability": "VCID-58ua-fyne-u7fj" }, { "vulnerability": "VCID-a5f8-n9d2-eqff" }, { "vulnerability": "VCID-byja-84wd-bbep" }, { "vulnerability": "VCID-cp3v-jxnh-tug6" }, { "vulnerability": "VCID-h6a3-5vxq-pfav" }, { "vulnerability": "VCID-jfte-fyut-13cr" }, { "vulnerability": "VCID-msjj-w941-33aj" }, { "vulnerability": "VCID-nfz6-bse5-xyen" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@2.0.13" } ], "aliases": [ "CVE-2021-29472", "GHSA-h5h8-pc6h-jvvx" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vvbj-3291-z7g7" } ], "fixing_vulnerabilities": [], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/composer/composer@1.10.17" }