SUSE-SU-2026:3105-1

Details

Description of the patch:

This update for php-composer2 fixes the following issues:

CVE-2026-45793: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (bsc#1271504).
CVE-2026-59946: path traversal in package bin field lets dependencies chmod arbitrary host files (bsc#1271151).
CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs (bsc#1271129).
CVE-2026-59948: arbitrary file write outside vendordirectory via malicious transitive package name (bsc#1271122).

Affected Packages

php-composer2

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Web and Scripting 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server 15 SP7

Fixed in:

2.6.4-150600.3.12.1

References

ADVISORY

https://bugzilla.suse.com/1271122

ADVISORY

https://bugzilla.suse.com/1271129

ADVISORY

https://bugzilla.suse.com/1271151

ADVISORY

https://bugzilla.suse.com/1271504

ADVISORY