Considering the context in which this usage of `openssl_x509_parse()` occurs this is basically a complete non-issue. The very worst-case scenario is that your composer script segfaults. No one should be performing composer installations during script execution in a web SAPI environment, so there's no real DoS risk here. The advisory only has security implications if using the function to parse certificates submitted from an unsafe source.

Beyond this, for the "security vulnerability" to be exploitable in this case the *OS-managed cert store* must already have been compromised. If this is the case you have *significantly* larger problems than your composer script segfaulting.