Bug 2527244 - CVE-2026-84361 composer: Composer: Arbitrary code execution via malicious Perforce source URL [epel-all]
Summary: CVE-2026-84361 composer: Composer: Arbitrary code execution via malicious Per...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: composer
Version: epel10
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Remi Collet
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["2c846257-cefc-4761-ad33-c...
Depends On:
Blocks: CVE-2026-84361
TreeView+ depends on / blocked
 
Reported: 2026-09-02 07:16 UTC by Vladimir Vasilev
Modified: 2026-09-05 00:56 UTC (History)
1 user (show)

Fixed In Version: composer-2.10.3-1.el10_4 composer-2.10.3-1.el10_3 composer-2.10.3-1.el9 composer-2.10.3-1.el10_2
Clone Of:
Environment:
Last Closed: 2026-09-05 00:26:26 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Vladimir Vasilev 2026-09-02 07:16:01 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.
Comment 1 Fedora Update System 2026-09-02 09:20:46 UTC 
FEDORA-EPEL-2026-f1fcb9cda6 (composer-2.10.3-1.el10_4) has been submitted as an update to Fedora EPEL 10.4.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f1fcb9cda6
Comment 2 Fedora Update System 2026-09-02 09:20:55 UTC 
FEDORA-EPEL-2026-d1590297ab (composer-2.10.3-1.el10_2) has been submitted as an update to Fedora EPEL 10.2.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-d1590297ab
Comment 3 Fedora Update System 2026-09-02 09:21:07 UTC 
FEDORA-EPEL-2026-9a4c6ee5c5 (composer-2.10.3-1.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-9a4c6ee5c5
Comment 4 Fedora Update System 2026-09-02 09:21:26 UTC 
FEDORA-EPEL-2026-bf7afd5dc2 (composer-2.10.3-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-bf7afd5dc2
Comment 5 Fedora Update System 2026-09-05 00:26:26 UTC 
FEDORA-EPEL-2026-f1fcb9cda6 (composer-2.10.3-1.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 6 Fedora Update System 2026-09-05 00:26:29 UTC 
FEDORA-EPEL-2026-9a4c6ee5c5 (composer-2.10.3-1.el10_3) has been pushed to the Fedora EPEL 10.3 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 7 Fedora Update System 2026-09-05 00:44:53 UTC 
FEDORA-EPEL-2026-bf7afd5dc2 (composer-2.10.3-1.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 8 Fedora Update System 2026-09-05 00:56:47 UTC 
FEDORA-EPEL-2026-d1590297ab (composer-2.10.3-1.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository.
If problem still persists, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.