CVE-2024-10224
Last modified
CVE-2024-10224 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().. EPSS estimates a 8.60% chance of exploitation in the next 30 days.
Description
Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Rschupp | Modules\ | < 1.36 | Scandeps |
| Debian | Debian Linux | 11.0 | — |
References
- https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529Exploit, Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-10224Third Party Advisory
- https://www.qualys.com/2024/11/19/needrestart/needrestart.txtExploit, Mitigation
- https://www.openwall.com/lists/oss-security/2024/11/19/1Exploit, Mailing List, Mitigation
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-10224?
How severe is CVE-2024-10224?
How do I fix CVE-2024-10224?
Are you affected by CVE-2024-10224?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST