VDB
CVE-2024-11003
CVE-2024-11003
PUBLISHED
CVSS 7.800000190734863 HIGH
Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.
EPSS 11.47% · 95.7th percentile
Risk Scores
CVSS 3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
11.47%
95.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| needrestart_project | needrestart | 0, 0 |
| needrestart | needrestart | 0, 0 |
| needrestart_project | needrestart | 0, 0, 0 |
Timeline
- Nov 19, 2024 Coalition ESS Score
- Nov 19, 2024 Coalition ESS Score
- Nov 19, 2024 CVE Published
- Nov 20, 2024 EPSS Score
- Nov 21, 2024 PoC Published
- Nov 23, 2024 PoC Published
- Nov 24, 2024 PoC Published
- Nov 24, 2024 PoC Published
- Nov 24, 2024 PoC Published
- Nov 28, 2024 PoC Published
- Nov 28, 2024 PoC Published
- Dec 26, 2024 EPSS Score
References
- https://www.cve.org/CVERecord?id=CVE-2024-10224 issue
- http://seclists.org/fulldisclosure/2024/Nov/17 url
- https://github.com/liske/needrestart/commit/0f80a348883f72279a859ee655f58da34babefb0 url
- https://www.openwall.com/lists/oss-security/2024/11/19/1 url
- https://www.qualys.com/2024/11/19/needrestart/needrestart.txt advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-11003 advisory
- https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html url
- https://www.cve.org/CVERecord?id=CVE-2024-11003 url