CVE-2024-10224
Published: November 20, 2024Last modified: November 22, 2024
Description
Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.3 |
| Attack Vector | LOCAL |
| Attack complexity | LOW |
| Privileges required | LOW |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | LOW |
| Integrity impact | LOW |
| Availability impact | LOW |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | perl-module-scandeps | Fixed (1.31-r2) |
| Stream | perl-module-scandeps | Fixed (1.37-r0) |
References
- https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529
- https://lists.debian.org/debian-lts-announce/2024/11/msg00015.html
- https://www.cve.org/CVERecord?id=CVE-2024-10224
- https://www.openwall.com/lists/oss-security/2024/11/19/1
- https://www.qualys.com/2024/11/19/needrestart/needrestart.txt