Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().
Metrics
Affected Vendors & Products
References
History
Tue, 03 Dec 2024 14:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
References |
|
Fri, 22 Nov 2024 14:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Title | module-scandeps: local privilege escalation via unsanitized input | |
Weaknesses | CWE-20 | |
References |
| |
Metrics |
threat_severity
|
threat_severity
|
Fri, 22 Nov 2024 12:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
References |
|
Tue, 19 Nov 2024 20:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Module Scandeps
Module Scandeps needrestart |
|
Weaknesses | CWE-78 | |
CPEs | cpe:2.3:a:module_scandeps:needrestart:*:*:*:*:*:*:*:* | |
Vendors & Products |
Module Scandeps
Module Scandeps needrestart |
|
Metrics |
ssvc
|
Tue, 19 Nov 2024 17:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval(). | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: canonical
Published: 2024-11-19T17:35:25.014Z
Updated: 2024-12-03T13:33:19.825Z
Reserved: 2024-10-21T21:33:36.406Z
Link: CVE-2024-10224
Vulnrichment
Updated: 2024-12-03T13:33:19.825Z
NVD
Status : Awaiting Analysis
Published: 2024-11-19T18:15:19.773
Modified: 2024-12-03T14:15:19.270
Link: CVE-2024-10224
Redhat