-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4907-1 security@debian.org https://www.debian.org/security/ Sebastien Delafond April 29, 2021 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : composer CVE ID : CVE-2021-29472 It was discovered that composer, a dependency manager for PHP, did not properly sanitize Mercurial URLs, which could lead to arbitrary code execution. For the stable distribution (buster), this problem has been fixed in version 1.8.4-1+deb10u1. We recommend that you upgrade your composer packages. For the detailed security status of composer please refer to its security tracker page at: https://security-tracker.debian.org/tracker/composer Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmCK4LkACgkQEL6Jg/PV nWQhBwgArIovQUUooqTS91bHsjuqtP5cXvbbeSbLml9cRug6U83QJEeDOnLz/ljd K0gZLZIHAi7B9iMX/oeSA73VYmSyfEp1DhSaluGSMkbvzptONDt6j/wKc23Zr/A8 C8/wcD1k4rIC3VmyEWNKtO/qZZ+nt/WX6Fpq4PrlOdhO3ea/hctzlz3UacVoThwD HSHBHn5pWQygHQYdWva/HNeeEtwE81gBaQ3BYYJ+NWgZilfHW2pU5ilhWi2jur3z nwgpqIKVhfhC3jG4552n15E5i5T28LR8IXfijtHr91b4Q2ZtVdKQdSYs8UO0+jA8 Lz0xVj6CyVNsrmXe3fMzkIVeIzA04g== =2MWQ -----END PGP SIGNATURE-----