{
  "document" : {
    "aggregate_severity" : {
      "text" : "mittel"
    },
    "category" : "csaf_base",
    "csaf_version" : "2.0",
    "distribution" : {
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "de-DE",
    "notes" : [ {
      "category" : "legal_disclaimer",
      "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen."
    }, {
      "category" : "description",
      "text" : "Composer ist ein Open-Source-Abhängigkeitsmanager für PHP-Projekte.",
      "title" : "Produktbeschreibung"
    }, {
      "category" : "summary",
      "text" : "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Composer ausnutzen, um Sicherheitsmechanismen zu umgehen, um beliebige Dateien zu schreiben oder um Informationen offenzulegen. Zur erfolgreichen Ausnutzung sind teilweise bestimmte Konfigurationen erforderlich.",
      "title" : "Angriff"
    }, {
      "category" : "general",
      "text" : "- Linux\n- UNIX\n- Windows",
      "title" : "Betroffene Betriebssysteme"
    } ],
    "publisher" : {
      "category" : "other",
      "contact_details" : "csaf-provider@cert-bund.de",
      "name" : "Bundesamt für Sicherheit in der Informationstechnik",
      "namespace" : "https://www.bsi.bund.de"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "WID-SEC-W-2026-2235 - CSAF Version",
      "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2235.json"
    }, {
      "category" : "self",
      "summary" : "WID-SEC-2026-2235 - Portal Version",
      "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2235"
    }, {
      "category" : "external",
      "summary" : "Composer Release List vom 2026-07-07",
      "url" : "https://github.com/composer/composer/releases"
    }, {
      "category" : "external",
      "summary" : "GitHub Security Advisory GHSA-499r-g7pc-vmp9 vom 2026-07-07",
      "url" : "https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9"
    }, {
      "category" : "external",
      "summary" : "GitHub Security Advisory GHSA-g6xq-892h-64w3 vom 2026-07-07",
      "url" : "https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3"
    }, {
      "category" : "external",
      "summary" : "GitHub Security Advisory GHSA-gjfg-22fp-rrxx vom 2026-07-07",
      "url" : "https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx"
    }, {
      "category" : "external",
      "summary" : "Composer GitHub Pull Request 12948",
      "url" : "https://github.com/composer/composer/pull/12948"
    }, {
      "category" : "external",
      "summary" : "Composer GitHub Pull Request 12946",
      "url" : "https://github.com/composer/composer/pull/12946"
    }, {
      "category" : "external",
      "summary" : "Composer GitHub Pull Request 12959",
      "url" : "https://github.com/composer/composer/pull/12959"
    }, {
      "category" : "external",
      "summary" : "SUSE Security Update SUSE-SU-2026:3105-1 vom 2026-07-17",
      "url" : "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027619.html"
    }, {
      "category" : "external",
      "summary" : "SUSE Security Update SUSE-SU-2026:23116-1 vom 2026-08-14",
      "url" : "https://lists.suse.com/pipermail/sle-security-updates/2026-August/028327.html"
    }, {
      "category" : "external",
      "summary" : "SUSE Security Update SUSE-SU-2026:23138-1 vom 2026-08-14",
      "url" : "https://lists.suse.com/pipermail/sle-security-updates/2026-August/028309.html"
    } ],
    "source_lang" : "en-US",
    "title" : "Composer: Mehrere Schwachstellen",
    "tracking" : {
      "current_release_date" : "2026-08-16T22:00:00.000+00:00",
      "generator" : {
        "date" : "2026-08-17T09:13:11.980+00:00",
        "engine" : {
          "name" : "BSI-WID",
          "version" : "1.6.0"
        }
      },
      "id" : "WID-SEC-W-2026-2235",
      "initial_release_date" : "2026-07-07T22:00:00.000+00:00",
      "revision_history" : [ {
        "date" : "2026-07-07T22:00:00.000+00:00",
        "number" : "1",
        "summary" : "Initiale Fassung"
      }, {
        "date" : "2026-07-08T22:00:00.000+00:00",
        "number" : "2",
        "summary" : "Referenz(en) aufgenommen: EUVD-2026-42363, EUVD-2026-42362, EUVD-2026-42360"
      }, {
        "date" : "2026-07-19T22:00:00.000+00:00",
        "number" : "3",
        "summary" : "Neue Updates von SUSE aufgenommen"
      }, {
        "date" : "2026-08-16T22:00:00.000+00:00",
        "number" : "4",
        "summary" : "Neue Updates von SUSE aufgenommen"
      } ],
      "status" : "final",
      "version" : "4"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_version_range",
          "name" : "<2.2.29",
          "product" : {
            "name" : "Open Source Composer <2.2.29",
            "product_id" : "T056248"
          }
        }, {
          "category" : "product_version",
          "name" : "2.2.29",
          "product" : {
            "name" : "Open Source Composer 2.2.29",
            "product_id" : "T056248-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:getcomposer:composer:2.2.29"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "<2.10.2",
          "product" : {
            "name" : "Open Source Composer <2.10.2",
            "product_id" : "T056249"
          }
        }, {
          "category" : "product_version",
          "name" : "2.10.2",
          "product" : {
            "name" : "Open Source Composer 2.10.2",
            "product_id" : "T056249-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:getcomposer:composer:2.10.2"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "Composer"
      } ],
      "category" : "vendor",
      "name" : "Open Source"
    }, {
      "branches" : [ {
        "category" : "product_name",
        "name" : "SUSE Linux",
        "product" : {
          "name" : "SUSE Linux",
          "product_id" : "T054646",
          "product_identification_helper" : {
            "cpe" : "cpe:/o:suse:suse_linux:-"
          }
        }
      } ],
      "category" : "vendor",
      "name" : "SUSE"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2026-59946",
    "product_status" : {
      "known_affected" : [ "T056248", "T056249", "T054646" ]
    },
    "release_date" : "2026-07-07T22:00:00.000+00:00",
    "title" : "CVE-2026-59946"
  }, {
    "cve" : "CVE-2026-59947",
    "product_status" : {
      "known_affected" : [ "T056248", "T056249", "T054646" ]
    },
    "release_date" : "2026-07-07T22:00:00.000+00:00",
    "title" : "CVE-2026-59947"
  }, {
    "cve" : "CVE-2026-59948",
    "product_status" : {
      "known_affected" : [ "T056248", "T056249", "T054646" ]
    },
    "release_date" : "2026-07-07T22:00:00.000+00:00",
    "title" : "CVE-2026-59948"
  } ]
}