Vulnerability Description
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Needrestart Project | Needrestart | < 3.8 |
Related Weaknesses (CWE)
References
- https://github.com/liske/needrestart/commit/fcc9a4401392231bef4ef5ed026a0d7a2751Patch
- https://www.cve.org/CVERecord?id=CVE-2024-48990VDB Entry
- https://www.qualys.com/2024/11/19/needrestart/needrestart.txtThird Party Advisory
- http://seclists.org/fulldisclosure/2024/Nov/17
- https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html
- https://www.openwall.com/lists/oss-security/2024/11/19/1Mailing List
FAQ
What is CVE-2024-48990?
CVE-2024-48990 is a vulnerability with a CVSS score of 7.8 (HIGH). Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled...
How severe is CVE-2024-48990?
CVE-2024-48990 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-48990?
Check the references section above for vendor advisories and patch information. Affected products include: Needrestart Project Needrestart.