Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: composer fixed in 2.9.3-r0
AnalysisAI
Composer, the PHP dependency manager, received a security fix in Alpine Linux package version 2.9.3-r0. The nature, severity, and scope of the underlying vulnerability are not disclosed in available intelligence sources - the CVE record contains only a fix notation from the Alpine Linux vendor with no description of the flaw, affected functionality, or attack surface. No CVSS score, CWE classification, or exploit indicators are available; the EPSS exploitation probability is 0.03% (11th percentile), reflecting a very low current risk signal. Users running Composer on Alpine Linux should upgrade as a precaution.
Technical ContextAI
Composer is a widely deployed PHP dependency management tool used to declare, resolve, and install project libraries. On Alpine Linux it is distributed as a native package (apk). The fix version 2.9.3-r0 follows Alpine's versioning convention where '2.9.3' corresponds to the upstream Composer release and '-r0' denotes the first Alpine package revision at that upstream version. No CWE classification has been published, so the root cause class - whether a path traversal, command injection, insecure deserialization, TOCTOU race, or other class - cannot be determined from available data. No CPE strings were provided in the intelligence feed to bound the exact affected version range.
Affected ProductsAI
Alpine Linux systems running the Composer PHP package manager in versions prior to 2.9.3-r0 are identified as affected. The exact upstream Composer version range is not confirmed from available data - the fix maps to Alpine package 2.9.3-r0, implying upstream Composer 2.9.3 or an Alpine-specific patch applied at that revision. No CPE strings were provided. The Alpine Linux vendor is the sole reporting source; no independent NVD or upstream Composer security advisory has been identified to corroborate or expand the affected version range.
RemediationAI
Update the Alpine Linux Composer package to version 2.9.3-r0 or later using 'apk upgrade composer' on affected Alpine Linux hosts. This is the only confirmed remediation action available from the vendor data. Because the vulnerability details are undisclosed, no targeted workarounds can be recommended with confidence - generic compensating controls (restricting Composer execution to trusted users, isolating build environments, disabling network access during dependency resolution) may reduce exposure but their relevance to the specific flaw is unverifiable. No additional advisory URL was provided in the intelligence feed. Monitor the Alpine Linux security tracker and the official Composer security advisories at getcomposer.org for further disclosure.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today