{"id":"CVE-2024-10224","aliases":["ALPINE-CVE-2024-10224","ALSA-2025:7350","AZL-53394","AZL-53397","BELL-CVE-2024-10224","DEBIAN-CVE-2024-10224","DLA-3958-1","DSA-5816-1","EUVD-2024-33491","GHSA-g597-359q-v529","OESA-2024-2496","RHSA-2025:7350","RLSA-2025:7350","UBUNTU-CVE-2024-10224","USN-7117-1","openSUSE-SU-2025:14635-1"],"status":"published","title":"Moderate: perl-Module-ScanDeps security update","description":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval().","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.08975,"percentile":0.95326,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2024-11-19T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"perl-module-scandeps","fixed_in":["1.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"perl-module-scandeps","fixed_in":["1.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"perl-module-scandeps","fixed_in":["1.37-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"perl-module-scandeps","fixed_in":["1.37-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"perl-Module-ScanDeps","fixed_in":["1.30-6.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"perl-Module-ScanDeps","fixed_in":["1.35-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl-Module-ScanDeps","fixed_in":["1.35-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl-module-scandeps","fixed_in":["1.31-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl-module-scandeps","fixed_in":["1.37-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libmodule-scandeps-perl","fixed_in":["1.31-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libmodule-scandeps-perl","fixed_in":["1.35-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libmodule-scandeps-perl","fixed_in":["1.35-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libmodule-scandeps-perl","fixed_in":["1.30-1+deb11u1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"perl-Module-ScanDeps","fixed_in":["1.31-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-Module-ScanDeps","fixed_in":["1.27-8.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"perl-Module-ScanDeps","fixed_in":["1.31-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"perl-Module-ScanDeps","fixed_in":["1.31-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-Module-ScanDeps","fixed_in":["1.31-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-Module-ScanDeps","fixed_in":["0:1.30-6.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"perl-Module-ScanDeps","fixed_in":["0:1.30-6.el9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodule-scandeps-perl","fixed_in":["1.20-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmodule-scandeps-perl","fixed_in":["1.24-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmodule-scandeps-perl","fixed_in":["1.27-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libmodule-scandeps-perl","fixed_in":["1.31-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libmodule-scandeps-perl","fixed_in":["1.35-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Module-ScanDeps","fixed_in":["1.370.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"perl-module-scandeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"perl-module-scandeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"perl-module-scandeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-module-scandeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-Module-ScanDeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-6.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"perl-Module-ScanDeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Module-ScanDeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl-module-scandeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31-r1"},{"fixed":"1.31-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl-module-scandeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31-r1"},{"fixed":"1.37-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-2+deb12u1"}]}],"versions":["1.31-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-1+deb11u1"}]}],"versions":["1.30-1"]},{"source":"osv","ecosystem":"Debian:12","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-2+deb12u1"}]}],"versions":["1.31-2"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"perl-Module-ScanDeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-Module-ScanDeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-8.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"perl-Module-ScanDeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"perl-Module-ScanDeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-Module-ScanDeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-Module-ScanDeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30-6.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"perl-Module-ScanDeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30-6.el9"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-1ubuntu0.1~esm1"}]}],"versions":["1.19-1","1.20-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-1ubuntu0.1~esm1"}]}],"versions":["1.23-1","1.24-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1ubuntu0.1~esm1"}]}],"versions":["1.27-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.1"}]}],"versions":["1.30-1","1.31-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-1ubuntu0.24.04.1"}]}],"versions":["1.31-2","1.34-1","1.35-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-1ubuntu0.1~esm1"}]}],"versions":["1.19-1","1.20-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1ubuntu0.1~esm1"}]}],"versions":["2.1-1","2.3-2","2.4-1","2.5-1","2.6-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-1ubuntu0.1~esm1"}]}],"versions":["1.23-1","1.24-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+esm1"}]}],"versions":["2.11-4","3.0-1","3.1-1","3.1-1ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1ubuntu0.1~esm1"}]}],"versions":["1.27-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+esm1"}]}],"versions":["3.4-5","3.4-6","3.4-6ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.1"}]}],"versions":["1.30-1","1.31-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-5ubuntu2.2"}]}],"versions":["3.5-4ubuntu2","3.5-5ubuntu1","3.5-5ubuntu2","3.5-5ubuntu2.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-1ubuntu0.24.04.1"}]}],"versions":["1.31-2","1.34-1","1.35-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-7ubuntu4.3"}]}],"versions":["3.6-5","3.6-6","3.6-7","3.6-7ubuntu3","3.6-7ubuntu4","3.6-7ubuntu4.1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Module-ScanDeps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.370.0-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"module::scandeps","product":"module::scandeps"},{"vendor":"module_scandeps","product":"needrestart"},{"vendor":"rschupp","product":"modules\\"}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2024-10224","tags":["issue-tracking","Third Party Advisory","report","advisory"]},{"url":"https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529","tags":["vendor-advisory","Exploit","Vendor Advisory","advisory","article","report"]},{"url":"https://www.qualys.com/2024/11/19/needrestart/needrestart.txt","tags":["third-party-advisory","Exploit","Mitigation","advisory","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00015.html","tags":["Mailing List","web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/11/19/1","tags":["Exploit","Mailing List","Mitigation","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/17","tags":["web"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/15","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-10224","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7350","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-10224","tags":["report"]},{"url":"https://bugzilla.redhat.com/2327329","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7350.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10224","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-10224","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10224.json","tags":["advisory"]},{"url":"https://github.com/rschupp/Module-ScanDeps","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-10224","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2496","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2327329","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7350.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7350","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-10224","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7117-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-11003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48992","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FPJ2TDENCEIIRZCH5POXOMCUVDE7WHXT/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10224","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-10224","description":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval().","status":"published","published":"2024-11-19T17:35:25.014Z","modified":"2025-11-03T21:51:05.694Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:01.972857Z"}],"euvd":[{"id":"EUVD-2024-33491","description":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval().","status":"published","published":"2024-11-19T17:35:25Z","modified":"2025-11-03T21:51:05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:30.775561Z"}],"nvd":[{"id":"CVE-2024-10224","description":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval().","status":"published","published":"2024-11-19T18:15:19.773Z","modified":"2026-06-17T06:55:11.433Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:37.632431Z"}],"osv":[{"id":"ALPINE-CVE-2024-10224","description":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval().","status":"published","published":"2024-11-19T18:15:19.773Z","modified":"2026-11-02T11:17:50.050448982Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-10224","status":"published","published":"2024-11-20T05:59:43.65517Z","modified":"2026-01-26T09:42:46.822049Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-10224","description":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval().","status":"published","published":"2024-11-19T17:35:25.014Z","modified":"2026-10-28T02:31:05.325715728Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"DEBIAN-CVE-2024-10224","description":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval().","status":"published","published":"2024-11-19T18:15:19.773Z","modified":"2026-11-02T12:00:21.43644188Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2024-2496","title":"perl-Module-ScanDeps security update","description":"This module scans potential modules used by perl programs, and returns a hash reference; its keys are the module  names as appears in %INC (e.g. Test/More.pm); the values are hash references.\r\n\r\nSecurity Fix(es):\r\n\r\nQualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \u0026quot;pesky pipe\u0026quot; (such as passing \u0026quot;commands|\u0026quot; as a filename) or by passing arbitrary strings to eval().(CVE-2024-10224)","status":"published","published":"2024-11-29T11:07:58Z","modified":"2026-08-18T01:18:41.58572819Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2025:7350","title":"Red Hat Security Advisory: perl-Module-ScanDeps security update","status":"published","published":"2025-05-14T10:06:08Z","modified":"2026-06-30T10:27:50Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:7350","title":"Moderate: perl-Module-ScanDeps security update","description":"This module scans potential modules used by perl programs and returns a hash reference.  Its keys are the module names as they appear in %INC (e.g. Test/More.pm).  The values are hash references.\n\nSecurity Fix(es):\n\n* module-scandeps: local privilege escalation via unsanitized input (CVE-2024-10224)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.6 Release Notes linked from the References section.","status":"published","published":"2025-10-04T00:11:52.256858Z","modified":"2025-10-07T17:40:39.36328Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2024-10224","description":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval().","status":"published","published":"2024-11-19T16:00:00Z","modified":"2026-02-04T04:03:12.998131Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"ALSA-2025:7350","title":"Moderate: perl-Module-ScanDeps security update","description":"This module scans potential modules used by perl programs and returns a hash reference. Its keys are the module names as they appear in %INC (e.g. Test/More.pm). The values are hash references.  \n\nSecurity Fix(es):  \n\n  * module-scandeps: local privilege escalation via unsanitized input (CVE-2024-10224)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:29.872183578Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-53394","title":"CVE-2024-10224 affecting package perl-Module-ScanDeps for versions less than 1.35-2","description":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval().","status":"published","published":"2024-11-19T18:15:19Z","modified":"2026-04-21T04:35:13.983681Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"AZL-53397","title":"CVE-2024-10224 affecting package perl-Module-ScanDeps for versions less than 1.35-3","description":"Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a \"pesky pipe\" (such as passing \"commands|\" as a filename) or by passing arbitrary strings to eval().","status":"published","published":"2024-11-19T18:15:19Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"DLA-3958-1","title":"libmodule-scandeps-perl - security update","status":"published","published":"2024-11-19T00:00:00Z","modified":"2026-03-09T02:10:29.720584Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5816-1","title":"libmodule-scandeps-perl - security update","status":"published","published":"2024-11-19T00:00:00Z","modified":"2026-03-09T02:10:07.320486Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2025:14635-1","title":"perl-Module-ScanDeps-1.370.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Module-ScanDeps-1.370.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-12T00:00:00Z","modified":"2026-02-04T02:54:12.712114Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"USN-7117-1","title":"Several security issues were fixed in needrestart and Module::ScanDeps","description":"Qualys discovered that needrestart passed unsanitized data to a library \n(libmodule-scandeps-perl) which expects safe input. A local attacker could\npossibly use this issue to execute arbitrary code as root.\n(CVE-2024-11003)\n\nQualys discovered that the library libmodule-scandeps-perl incorrectly \nparsed perl code. This could allow a local attacker to execute arbitrary\nshell commands. (CVE-2024-10224)\n\nQualys discovered that needrestart incorrectly used the PYTHONPATH \nenvironment variable to spawn a new Python interpreter. A local attacker \ncould possibly use this issue to execute arbitrary code as root. \n(CVE-2024-48990)\n\nQualys discovered that needrestart incorrectly checked the path to the\nPython interpreter. A local attacker could possibly use this issue to win\na race condition and execute arbitrary code as root. (CVE-2024-48991)\n\nQualys discovered that needrestart incorrectly used the RUBYLIB\nenvironment variable to spawn a new Ruby interpreter. A local attacker\ncould possibly use this issue to execute arbitrary code as root.\n(CVE-2024-48992)\n\n","status":"published","published":"2024-11-19T17:54:48Z","modified":"2026-06-25T13:32:30.173916018Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}