CVE-2022-30688
published 2022-05-17CVE-2022-30688: needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.41%
33.7th percentile
needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | needrestart | < needrestart 3.6-1 (bookworm) | needrestart 3.6-1 (bookworm) |
| needrestart | needrestart | >= 0 < 3.5-4+deb11u1 | 3.5-4+deb11u1 |
| needrestart | needrestart | >= 0 < 3.6-1 | 3.6-1 |
| needrestart | needrestart | >= 0 < 3.6-1 | 3.6-1 |
| needrestart | needrestart | >= 0 < 3.6-1 | 3.6-1 |
| needrestart_project | needrestart | >= 0.8 < 3.6 | 3.6 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
needrestart vulnerability
vendor_ubuntu·2022-05-17
CVE-2022-30688 needrestart vulnerability
Title: needrestart vulnerability
Summary: needrestart could be made to run programs.
Jakub Wilk discovered that needrestart incorrectly used some regular
expressions. A local attacker could possibly use this issue to execute
arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2022-30688: needrestart - needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. R...
vendor_debian·2022·CVSS 7.8
CVE-2022-30688 [HIGH] CVE-2022-30688: needrestart - needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. R...
needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.
Scope: local
bookworm: resolved (fixed in 3.6-1)
bullseye: resolved (fixed in 3.5-4+deb11u1)
forky: resolved (fixed in 3.6-1)
sid: resolved (fixed in 3.6-1)
trixie: resolved (fixed in 3.6-1)
GHSA
GHSA-6qgc-vw4g-mxw4: needrestart 0
ghsa_unreviewed·2022-05-18
CVE-2022-30688 [HIGH] CWE-269 GHSA-6qgc-vw4g-mxw4: needrestart 0
needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.
OSV
CVE-2022-30688: needrestart 0
osv·2022-05-17·CVSS 7.8
CVE-2022-30688 [HIGH] CVE-2022-30688: needrestart 0
needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2022/05/17/9https://github.com/liske/needrestart/commit/e6e58136e1e3c92296e2e810cb8372a5fe0dbd30https://github.com/liske/needrestart/releases/tag/v3.6https://lists.debian.org/debian-lts-announce/2022/05/msg00024.htmlhttps://lists.debian.org/debian-security-announce/2022/msg00105.htmlhttps://www.debian.org/security/2022/dsa-5137https://www.openwall.com/lists/oss-security/2022/05/17/9http://seclists.org/fulldisclosure/2024/Nov/15http://seclists.org/fulldisclosure/2024/Nov/17http://www.openwall.com/lists/oss-security/2022/05/17/9https://github.com/liske/needrestart/commit/e6e58136e1e3c92296e2e810cb8372a5fe0dbd30https://github.com/liske/needrestart/releases/tag/v3.6https://lists.debian.org/debian-lts-announce/2022/05/msg00024.htmlhttps://lists.debian.org/debian-security-announce/2022/msg00105.htmlhttps://www.debian.org/security/2022/dsa-5137https://www.openwall.com/lists/oss-security/2022/05/17/9
2022-05-17
Published