{"id":"CVE-2024-10224","state":"PUBLISHED","title":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by ope","description":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval().","publishedAt":"2024-11-19T17:35:25.014Z","updatedAt":"2025-11-03T21:51:05.694Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","source":"canonical"},"assigner":"canonical","products":["Module::ScanDeps Module::ScanDeps"],"affected":[{"vendor":"Module::ScanDeps","product":"Module::ScanDeps","packageName":"libmodule-scandeps-perl","versions":[{"version":"0","status":"affected","lessThan":"1.38","versionType":"semver"}],"repo":"https://github.com/rschupp/Module-ScanDeps","platforms":["Linux"]}],"references":["https://www.cve.org/CVERecord?id=CVE-2024-10224","https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529","https://www.qualys.com/2024/11/19/needrestart/needrestart.txt","https://lists.debian.org/debian-lts-announce/2024/11/msg00015.html","https://www.openwall.com/lists/oss-security/2024/11/19/1","http://seclists.org/fulldisclosure/2024/Nov/17","http://seclists.org/fulldisclosure/2024/Nov/15"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/10xxx/CVE-2024-10224.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-10224","state":"PUBLISHED","datePublished":"2024-11-19T17:35:25.014Z","dateUpdated":"2025-11-03T21:51:05.694Z","assignerShortName":"canonical","assignerOrgId":"cc1ad9ee-3454-478d-9317-d3e869d708bc","dateReserved":"2024-10-21T21:33:36.406Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval()."}],"affected":[{"vendor":"Module::ScanDeps","product":"Module::ScanDeps","packageName":"libmodule-scandeps-perl","versions":[{"version":"0","status":"affected","lessThan":"1.38","versionType":"semver"}],"repo":"https://github.com/rschupp/Module-ScanDeps","platforms":["Linux"]}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2024-10224","tags":["issue-tracking"]},{"url":"https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529","tags":["vendor-advisory"]},{"url":"https://www.qualys.com/2024/11/19/needrestart/needrestart.txt","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":5.3,"baseSeverity":"MEDIUM"}}],"providerMetadata":{"shortName":"canonical","orgId":"cc1ad9ee-3454-478d-9317-d3e869d708bc","dateUpdated":"2024-11-19T17:35:25.014Z"},"credits":[{"lang":"en","type":"finder","value":"Qualys"},{"lang":"en","type":"remediation developer","value":"Roderich Schupp"},{"lang":"en","type":"coordinator","value":"Mark Esler"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00015.html"},{"url":"https://www.openwall.com/lists/oss-security/2024/11/19/1"},{"url":"http://seclists.org/fulldisclosure/2024/Nov/17"},{"url":"http://seclists.org/fulldisclosure/2024/Nov/15"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T21:51:05.694Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"module_scandeps","product":"needrestart","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.38","versionType":"semver"}],"cpes":["cpe:2.3:a:module_scandeps:needrestart:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-19T19:59:43.081706Z","id":"CVE-2024-10224","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","type":"CWE","lang":"en","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-19T20:02:43.901Z"}}]}}}