Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
89
security advisoryfedoracriticalFedora 44 Composer Critical Shell Escaping Fix Advisory 2026-9b34a78e81
Version 2.10.1 - 2026-06-04 Security: Fixed shell escaping when opening an editor (#12903) Security: Verify backup phar signature before restoring it when using self- update --rollback (#12918) Fixed source-fallback also disabling fallbacks to dist install when source is. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-9b34a78e81 2026-06-13 01:09:32.029641+00:00 -------------------------------------------------------------------------------- Name : composer Product : Fedora 44 Version : 2.10.1 Release : 1.fc44 URL : https://getcomposer.org/ Summary : Dependency Manager for PHP Description : Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/ -------------------------------------------------------------------------------- Update Information: Version 2.10.1 - 2026-06-04 Security: Fixed shell escaping when opening an editor (#12903) Security: Verify backup phar signature before restoring it when using self- update --rollback (#12918) Fixed source-fallback also disabling fallbacks to dist install when source is the preferred install method (#12888) Fixed source -> dist package updates wiping the .git dir without checking for local changes first (#12912) Fixed GitHub token prompt happening multiple times on parallel auth failures (#12913) Fixed warnings from Composer repositories being printed twice in some cases (#12907) Version 2.10.0 Read the Composer 2.10 Release Announcement for more details on the release highlights. Full Changelog BC Break / Security: Disabled automatic fallback to source checkout if dist/zip install fails, we have introduced a new source-fallback config option as a temporary way to restore the old behavior, but if you need this talk to us as we plan to remove it entirely in 2.11 (#12885) BC Break: Minor break for audit consumers,the exit code is now always 0 (success) or 1 if anything failed the audit (#12881) Security: Added dependency policies to block package versions where malware was detected on update/install or report it with audit (#12786) Security: Hardened output filtering of URLs to reduce chances of token leaks (#12882, #12886) Security: Fixed handling of uppercase schemes in URL validation that might have allowed https requirement bypass (#12884) Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3) Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77) Security: Enforce allow-plugins even in non-interactive mode for very old pre-2.2 lock files (#12764) Added support for temporary --with constraints with wildcards in the package name for the update command (#12658) Added --strict-psr-autoloader flag to install and update commands (#12647) Added source-fallback config option to disable or enable source fallback on download failure (#12698) Added --require parameter to create-project to add new packages to the project as it gets installed (#12738) Optimized plugin autoloading by avoiding regenerating classmaps for every package per plugin (#12696) Optimized PoolOptimizer memory usage (#12783) Optimized classmap dumping performance Deprecated most of the audit config in favor of the new policy one (#12804, see #12786 for the RFC and upgrade docs) Fixed update --bump-after-update to only bump packages that actually were updated (#12733) Fixed GitHub API authentication errors not being visible to the user (#12737) Fixed error reporting for clarity when a constraint cannot be parsed (#12743) Fixed warning being shown when lock file is disabled (#12760) Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758) Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735) Fixed audit command returning a success code when the vendor dir was notpresent (#12880) -------------------------------------------------------------------------------- ChangeLog: * Thu Jun 4 2026 Remi Collet - 2.10.1-1 - update to 2.10.1 * Thu May 28 2026 Remi Collet - 2.10.0-1 - update to 2.10.0 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-9b34a78e81' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 12, 2026
•Critical
Fedora
98
security advisorymoderateRed HatRedHat: RHSA-2022-0108-01 Moderate: Ansible-Runner Shell Escaping Issue
An update is now available for ansible-runner for Red Hat Ansible Automation Platform 2.0 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: ansible-runner security and bug fix update Advisory ID: RHSA-2022:0108-01 Product: Red Hat Ansible Automation Platform Advisory URL: https://access.redhat.com/errata/RHSA-2022:0108 Issue date: 2022-01-11 CVE Names: CVE-2021-4041 ==================================================================== 1. Summary: An update is now available for ansible-runner for Red Hat Ansible Automation Platform 2.0 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Ansible Automation Platform 2.0 for RHEL 8 - noarch 3. Description: Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * ansible-runner: Ansible: Improper shell escaping (CVE-2021-4041) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in theReferences section. Additional Changes: This update fixes various bugs and adds enhancements. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2028074 - CVE-2021-4041 Ansible: Improper shell escaping in ansible-runner 6. Package List: Red Hat Ansible Automation Platform 2.0 for RHEL 8: Source: ansible-runner-2.0.3-2.el8ap.src.rpm noarch: ansible-runner-2.0.3-2.el8ap.noarch.rpm python38-ansible-runner-2.0.3-2.el8ap.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-4041 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYeGX6NzjgjWX9erEAQiQQA//aCzYgMkZE7jZWg9XilGWwmPeMMF2AaYc h3ESEpWd2fu3RQJmfhB2XFHv8BP0uWEoXTndbC9I91H48Ezmt0ty353vcXed7SNu a2xY5Kw1cK5QWOTRKmn4woZmw2+Rmi4Az01atvo4oryFgYY3/mohTpth+KDdfD7p Un/ILCVfh6XX3HjQiXp2Fal9fgUl7I2kbhzWzo+iyAhShQDsQR0iCMuH7nZBcq7z 7dY3PMEs6C7cBGhK0PvMhJMvGIdA2dJTBD2bgYp1vdcZjRTrui6WBE1efV1Lm0Sf iFpkn2E1pdX2luGHYiC8gIWDzhlY5845PDzpA4ChCYn2X1iKBHRTYKRb8mvag1zq 6gTUogdD5vxhmEoVzqidnBXbBqZBNubu9oMBP0xdE5JrhqsCRrY1tofZVEVRPnra kS3Zb9vhlSVdfbEr5Ywzot6mm2oL1xXUwSkw+ENRCgVmtADDoFOexKSPp3lSTclD wxL27+NabomdXtyPxxGM3SPpWdxrLlDSR0EWh+ufMaYKu/PR/JNsE+xRWYok+l8W A730d/HxgLne9xhpG3utPvq5SL9lQYDsB7yXPPgYrkkbdvYoXPlFvTu/XxsUKb0k k//jHHMbyMUaHBXZn2t/OGdTgVCmQcz7gj3jHA8VJSewe2zjCeXNvBjjfdQMW8R0 R4El11JtWOU=Xylc -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jan 14, 2022
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!