Description
Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
composer composer
>= 1.0, < 1.10.28affected>= 2.0.0, < 2.2.28affected>= 2.3.0, < 2.9.8affected
References
- https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2 ↗
- https://github.com/composer/composer/pull/12853 ↗
- https://github.com/composer/composer/pull/12855 ↗
- https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039 ↗
- https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1 ↗
- https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714 ↗
- https://github.com/composer/composer/releases/tag/1.10.28 ↗
- https://github.com/composer/composer/releases/tag/2.2.28 ↗
- https://github.com/composer/composer/releases/tag/2.9.8 ↗