Vulnerability Description
Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Needrestart Project | Needrestart | < 3.8 |
Related Weaknesses (CWE)
References
- https://github.com/liske/needrestart/commit/0f80a348883f72279a859ee655f58da34babPatch
- https://www.cve.org/CVERecord?id=CVE-2024-10224VDB Entry
- https://www.cve.org/CVERecord?id=CVE-2024-11003VDB Entry
- https://www.qualys.com/2024/11/19/needrestart/needrestart.txtThird Party Advisory
- http://seclists.org/fulldisclosure/2024/Nov/17
- https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html
- https://www.openwall.com/lists/oss-security/2024/11/19/1Mailing List
FAQ
What is CVE-2024-11003?
CVE-2024-11003 is a vulnerability with a CVSS score of 7.8 (HIGH). Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell ...
How severe is CVE-2024-11003?
CVE-2024-11003 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-11003?
Check the references section above for vendor advisories and patch information. Affected products include: Needrestart Project Needrestart.