Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
heroku/heroku-buildpack-php
main @ b1d8545
3
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Information Disclosure: 1 prior fix. Scrutinize any change in this area.
support/build/_util: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Signature Verification Bypass: The PHP build formula validated the Composer installer signature but did not halt execution upon verification failure, allowing invalid or malicious payloads to run. Security depends on ensuring all verification scripts explicitly abort on non-zero exit statuses or hash mismatches.
Insecure Installation: Directly executing downloaded setup scripts from external URLs without validating their SHA-384 checksums introduces remote code execution risks if the distribution network is compromised.
Information Disclosure: The hardcoded inclusion of the public ACL flag when uploading repository files and metadata to S3 leaks internal directory structures and build artifacts to the public internet.