CVE-2024-10224OS Command Injection in Modules

Severity
7.8HIGHNVD
EPSS
0.6%
top 29.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedNov 19
Latest updateDec 5

Description

Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages10 packages

Also affects: Debian Linux 11.0

🔴Vulnerability Details

6
OSV
needrestart regression2024-12-05
OSV
needrestart regression2024-11-26
OSV
CVE-2024-11003: Qualys discovered that needrestart, before version 32024-11-19
OSV
Several security issues were fixed in needrestart and Module::ScanDeps2024-11-19
GHSA
GHSA-9f4h-r2c7-m6w4: Qualys discovered that needrestart, before version 32024-11-19

📋Vendor Advisories

7
Ubuntu
needrestart regression2024-12-05
Ubuntu
needrestart regression2024-11-26
Red Hat
module-scandeps: local privilege escalation via unsanitized input2024-11-19
Ubuntu
needrestart and Module::ScanDeps vulnerabilities2024-11-19
Microsoft
Qualys discovered that if unsanitized input was used with the library Modules: ScanDeps2024-11-12

🕵️Threat Intelligence

5
Qualys
Mitigate High-Risk Vulnerabilities Using TruRisk | Qualys2024-12-04
Qualys
Proactively Managing High-Risk Vulnerabilities with TruRisk Mitigate™2024-12-04
Bleepingcomputer
Ubuntu Linux impacted by decade-old 'needrestart' flaw that gives root2024-11-20
Qualys
Qualys TRU Uncovers Five Local Privilege Escalation Vulnerabilities in needrestart2024-11-19
Qualys
Qualys TRU Uncovers 5 Local Privilege Escalation Flaws | Qualys2024-11-19
CVE-2024-10224 — OS Command Injection in Modules | cvebase