Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2024-11003: Needrestart Passes Sensitive Data to Shell, Potentially Allowing Local Attack
CVE-2024-11003 · published 1 year ago
Summary
The needrestart software before version 3.8 has a security flaw that could let a local attacker run any command on the system. This happens because needrestart passes certain data to a library without checking it first. To stay safe, update needrestart to version 3.8 or later.
What to do
- Update debian needrestart to version 3.5-4+deb11u4.
- Update debian needrestart to version 3.6-4+deb12u2.
- Update debian needrestart to version 3.7-3.1.
- Update needrestart_project needrestart to version 3.8 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | needrestart_project | needrestart |
< 3.8 cpe:2.3:a:needrestart_project:needrestart:*:*:*:*:*:*:*:* |
| Debian:11 | debian | needrestart |
< 3.5-4+deb11u4 Fix: upgrade to 3.5-4+deb11u4
|
| Debian:12 | debian | needrestart |
< 3.6-4+deb12u2 Fix: upgrade to 3.6-4+deb12u2
|
| Debian:13 | debian | needrestart |
< 3.7-3.1 Fix: upgrade to 3.7-3.1
|
| Debian:14 | debian | needrestart |
< 3.7-3.1 Fix: upgrade to 3.7-3.1
|
Original advisory text
Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary she...
Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.
References
- http://seclists.org/fulldisclosure/2024/Nov/17 URL
- https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html URL
- https://www.openwall.com/lists/oss-security/2024/11/19/1 URL
- https://security-tracker.debian.org/tracker/CVE-2024-11003 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11003... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-11003 Vendor Advisory
- https://www.qualys.com/2024/11/19/needrestart/needrestart.txt Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-10224 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-11003 Third Party Advisory
- https://github.com/liske/needrestart/commit/0f80a348883f72279a859ee655f58da34bab... Patch
- https://github.com/liske/needrestart Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-78OS Command Injection
Timeline
Published19 Nov 2024
Updated2 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta