Every CVE Search/ Get API key

CVE-2024-11003

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library ...

7.8 HighPublic exploitFix available

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

12.0%Up 12.0 points since Nov 20, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.8

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.

Record
CVE-2024-11003
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2024-33730 7.8

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.

Record
EUVD-2024-33730
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9f4h-r2c7-m6w4 7.8

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library ...

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.

Record
GHSA-9f4h-r2c7-m6w4
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
NVD 7.8

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.

Record
CVE-2024-11003
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSV 7.8

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.

Record
CVE-2024-11003
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-11003 7.8

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.

Record
DEBIAN-CVE-2024-11003
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2024-11003 7.8

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.

Record
UBUNTU-CVE-2024-11003
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2024-1734028058 No score

Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992

  • SECURITY UPDATE: Prevent running the Python interpreter with an attacker-controlled PYTHONPATH environment variable
    • debian/patches/CVE-2024-48990-CVE-2024-48991.patch: do not set PYTHONPATH environment variable to prevent a LPE and prevent race condition on /proc/$PID/exec evaluation
    • CVE-2024-48990
    • CVE-2024-48991
  • SECURITY UPDATE: Prevent running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable
    • debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE
    • CVE-2024-48992
  • SECURITY UPDATE: Prevent running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable
    • debian/patches/CVE-2024-11003.patch, debian/control: drop usage of Module::ScanDeps to prevent LPE
    • CVE-2024-11003
Record
CLSA-2024-1734028058
Updated
2026-11-02
OSVCLSA-2026-1778933429 No score

Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992

  • SECURITY UPDATE: drop usage of Module::ScanDeps to prevent LPE
    • debian/patches/CVE-2024-11003.patch: drop usage of Module::ScanDeps to prevent LPE
    • CVE-2024-11003
  • SECURITY UPDATE: do not set PYTHONPATH environment variable to prevent a LPE
    • debian/patches/CVE-2024-48990.patch: do not set PYTHONPATH environment variable to prevent a LPE
    • CVE-2024-48990
  • SECURITY UPDATE: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression
    • debian/patches/CVE-2024-48991.patch: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression
    • CVE-2024-48991
  • SECURITY UPDATE: do not set RUBYLIB environment variable to prevent a LPE
    • debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE
    • CVE-2024-48992
Record
CLSA-2026-1778933429
Updated
2026-11-02
OSVUSN-7117-1 No score

Several security issues were fixed in needrestart and Module::ScanDeps

Qualys discovered that needrestart passed unsanitized data to a library (libmodule-scandeps-perl) which expects safe input. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-11003)

Qualys discovered that the library libmodule-scandeps-perl incorrectly parsed perl code. This could allow a local attacker to execute arbitrary shell commands. (CVE-2024-10224)

Qualys discovered that needrestart incorrectly used the PYTHONPATH environment variable to spawn a new Python interpreter. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-48990)

Qualys discovered that needrestart incorrectly checked the path to the Python interpreter. A local attacker could possibly use this issue to win a race condition and execute arbitrary code as root. (CVE-2024-48991)

Qualys discovered that needrestart incorrectly used the RUBYLIB environment variable to spawn a new Ruby interpreter. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-48992)

Record
USN-7117-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
needrestart
TuxCare:Ubuntu:16.04
From an advisory covering 4 CVEs
 before 2.6-1+tuxcare.els1
2.6-1+tuxcare.els1
needrestart
TuxCare:Ubuntu:20.04
From an advisory covering 4 CVEs
 before 3.4-6ubuntu0.1+tuxcare.els1
3.4-6ubuntu0.1+tuxcare.els1
needrestart
Debian:12
 before 3.6-4+deb12u2, plus listed versions
3.6-43.6-4+deb12u1
3.6-4+deb12u2
needrestart
Debian:13
 before 3.7-3.1
3.7-3.1
needrestart
Debian:14
 before 3.7-3.1
3.7-3.1
needrestart
Debian:11
From an advisory covering 4 CVEs
 before 3.5-4+deb11u4, plus listed versions
3.5-43.5-4+deb11u13.5-4+deb11u23.5-4+deb11u3
3.5-4+deb11u4
needrestart
Debian:12
From an advisory covering 4 CVEs
 before 3.6-4+deb12u2, plus listed versions
3.6-43.6-4+deb12u1
3.6-4+deb12u2
needrestart
Ubuntu:Pro:16.04:LTS
 before 2.6-1ubuntu0.1~esm1, plus listed versions
2.1-12.3-22.4-12.5-12.6-1
2.6-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:18.04:LTS
 before 3.1-1ubuntu0.1+esm1, plus listed versions
2.11-43.0-13.1-13.1-1ubuntu0.1
3.1-1ubuntu0.1+esm1
needrestart
Ubuntu:Pro:20.04:LTS
 before 3.4-6ubuntu0.1+esm1, plus listed versions
3.4-53.4-63.4-6ubuntu0.1
3.4-6ubuntu0.1+esm1
Show 12 moreShow less
Affected packages
PackageAffectedFixed
needrestart
Ubuntu:22.04:LTS
 before 3.5-5ubuntu2.2, plus listed versions
3.5-4ubuntu23.5-5ubuntu13.5-5ubuntu23.5-5ubuntu2.1
3.5-5ubuntu2.2
needrestart
Ubuntu:24.04:LTS
 before 3.6-7ubuntu4.3, plus listed versions
3.6-53.6-63.6-73.6-7ubuntu33.6-7ubuntu43.6-7ubuntu4.1
3.6-7ubuntu4.3
libmodule-scandeps-perl
Ubuntu:Pro:16.04:LTS
From an advisory covering 5 CVEs
 before 1.20-1ubuntu0.1~esm1, plus listed versions
1.19-11.20-1
1.20-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:16.04:LTS
From an advisory covering 5 CVEs
 before 2.6-1ubuntu0.1~esm1, plus listed versions
2.1-12.3-22.4-12.5-12.6-1
2.6-1ubuntu0.1~esm1
libmodule-scandeps-perl
Ubuntu:Pro:18.04:LTS
From an advisory covering 5 CVEs
 before 1.24-1ubuntu0.1~esm1, plus listed versions
1.23-11.24-1
1.24-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:18.04:LTS
From an advisory covering 5 CVEs
 before 3.1-1ubuntu0.1+esm1, plus listed versions
2.11-43.0-13.1-13.1-1ubuntu0.1
3.1-1ubuntu0.1+esm1
libmodule-scandeps-perl
Ubuntu:Pro:20.04:LTS
From an advisory covering 5 CVEs
 before 1.27-1ubuntu0.1~esm1, plus listed versions
1.27-1
1.27-1ubuntu0.1~esm1
needrestart
Ubuntu:Pro:20.04:LTS
From an advisory covering 5 CVEs
 before 3.4-6ubuntu0.1+esm1, plus listed versions
3.4-53.4-63.4-6ubuntu0.1
3.4-6ubuntu0.1+esm1
libmodule-scandeps-perl
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 1.31-1ubuntu0.1, plus listed versions
1.30-11.31-1
1.31-1ubuntu0.1
needrestart
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 3.5-5ubuntu2.2, plus listed versions
3.5-4ubuntu23.5-5ubuntu13.5-5ubuntu23.5-5ubuntu2.1
3.5-5ubuntu2.2
libmodule-scandeps-perl
Ubuntu:24.04:LTS
From an advisory covering 5 CVEs
 before 1.35-1ubuntu0.24.04.1, plus listed versions
1.31-21.34-11.35-1
1.35-1ubuntu0.24.04.1
needrestart
Ubuntu:24.04:LTS
From an advisory covering 5 CVEs
 before 3.6-7ubuntu4.3, plus listed versions
3.6-53.6-63.6-73.6-7ubuntu33.6-7ubuntu43.6-7ubuntu4.1
3.6-7ubuntu4.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubsychikov/CVE-2024-11003-POC2026-02-12

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-11003 is a high vulnerability (CVSS 7.8) in Needrestart, published November 19, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.0%, the 96th percentile. Fixed in needrestart 3.6-4+deb12u2.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open