{"id":"CVE-2024-11003","aliases":["CLSA-2024-1734028058","CLSA-2026-1778933429","DEBIAN-CVE-2024-11003","DLA-3957-1","DSA-5815-1","EUVD-2024-33730","GHSA-9f4h-r2c7-m6w4","UBUNTU-CVE-2024-11003","USN-7117-1"],"status":"published","title":"Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library ...","description":"Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.12041,"percentile":0.96172,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2024-11-19T00:00:00Z","modified":"2026-11-02T12:00:36Z","exploits":[{"source":"pocgithub","id":"sychikov/CVE-2024-11003-POC","title":"sychikov/CVE-2024-11003-POC","date":"2026-02-12","url":"https://github.com/sychikov/CVE-2024-11003-POC"}],"fixes":[{"ecosystem":"Debian:12","package":"needrestart","fixed_in":["3.6-4+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"needrestart","fixed_in":["3.7-3.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"needrestart","fixed_in":["3.7-3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","fixed_in":["2.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","fixed_in":["3.1-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","fixed_in":["3.4-6ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","fixed_in":["3.5-5ubuntu2.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","fixed_in":["3.6-7ubuntu4.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-4+deb12u2"}]}],"versions":["3.6-4","3.6-4+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-3.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-3.1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-4+deb11u4"}]}],"versions":["3.5-4","3.5-4+deb11u1","3.5-4+deb11u2","3.5-4+deb11u3"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-4+deb12u2"}]}],"versions":["3.6-4","3.6-4+deb12u1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1ubuntu0.1~esm1"}]}],"versions":["2.1-1","2.3-2","2.4-1","2.5-1","2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+esm1"}]}],"versions":["2.11-4","3.0-1","3.1-1","3.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+esm1"}]}],"versions":["3.4-5","3.4-6","3.4-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-5ubuntu2.2"}]}],"versions":["3.5-4ubuntu2","3.5-5ubuntu1","3.5-5ubuntu2","3.5-5ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-7ubuntu4.3"}]}],"versions":["3.6-5","3.6-6","3.6-7","3.6-7ubuntu3","3.6-7ubuntu4","3.6-7ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-1ubuntu0.1~esm1"}]}],"versions":["1.19-1","1.20-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1ubuntu0.1~esm1"}]}],"versions":["2.1-1","2.3-2","2.4-1","2.5-1","2.6-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-1ubuntu0.1~esm1"}]}],"versions":["1.23-1","1.24-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+esm1"}]}],"versions":["2.11-4","3.0-1","3.1-1","3.1-1ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1ubuntu0.1~esm1"}]}],"versions":["1.27-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+esm1"}]}],"versions":["3.4-5","3.4-6","3.4-6ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.1"}]}],"versions":["1.30-1","1.31-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-5ubuntu2.2"}]}],"versions":["3.5-4ubuntu2","3.5-5ubuntu1","3.5-5ubuntu2","3.5-5ubuntu2.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-1ubuntu0.24.04.1"}]}],"versions":["1.31-2","1.34-1","1.35-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-7ubuntu4.3"}]}],"versions":["3.6-5","3.6-6","3.6-7","3.6-7ubuntu3","3.6-7ubuntu4","3.6-7ubuntu4.1"],"bundled":5}],"products":[{"vendor":"needrestart","product":"needrestart"},{"vendor":"needrestart_project","product":"needrestart"}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11003","tags":["issue-tracking","VDB Entry","report"]},{"url":"https://github.com/liske/needrestart/commit/0f80a348883f72279a859ee655f58da34babefb0","tags":["patch","Patch","fix"]},{"url":"https://www.qualys.com/2024/11/19/needrestart/needrestart.txt","tags":["third-party-advisory","Third Party Advisory","advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-10224","tags":["issue-tracking","VDB Entry","report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/11/19/1","tags":["Mailing List","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/17","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11003","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9f4h-r2c7-m6w4"},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1734028058.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1778933429.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11003.json","tags":["advisory"]},{"url":"https://github.com/liske/needrestart","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-11003","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-11003","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7117-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-10224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48992","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-11003","description":"Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.","status":"published","published":"2024-11-19T17:36:36.682Z","modified":"2025-11-03T21:51:44.254Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:19.965827Z"}],"euvd":[{"id":"EUVD-2024-33730","description":"Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.","status":"published","published":"2024-11-19T17:36:36Z","modified":"2025-11-03T21:51:44Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-9f4h-r2c7-m6w4","title":"Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library ...","description":"Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.","status":"published","published":"2024-11-19T18:31:06Z","modified":"2025-11-04T00:33:10Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:32.302531Z"}],"nvd":[{"id":"CVE-2024-11003","description":"Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.","status":"published","published":"2024-11-19T18:15:19.973Z","modified":"2026-06-17T06:56:51.82Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:37.632431Z"}],"osv":[{"id":"CVE-2024-11003","description":"Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.","status":"published","published":"2024-11-19T17:36:36.682Z","modified":"2026-10-28T02:30:36.596448714Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"DEBIAN-CVE-2024-11003","description":"Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.","status":"published","published":"2024-11-19T18:15:19.973Z","modified":"2026-11-02T12:00:36.763237584Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"UBUNTU-CVE-2024-11003","description":"Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps.","status":"published","published":"2024-11-19T16:00:00Z","modified":"2026-02-04T02:57:04.452765Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"CLSA-2024-1734028058","title":"Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992","description":"   * SECURITY UPDATE: Prevent running the Python interpreter with an\n     attacker-controlled PYTHONPATH environment variable\n     - debian/patches/CVE-2024-48990-CVE-2024-48991.patch: do not set\n       PYTHONPATH environment variable to prevent a LPE and prevent\n       race condition on /proc/$PID/exec evaluation\n     - CVE-2024-48990\n     - CVE-2024-48991\n   * SECURITY UPDATE: Prevent running the Ruby interpreter with an\n     attacker-controlled RUBYLIB environment variable\n     - debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment\n       variable to prevent a LPE\n     - CVE-2024-48992\n   * SECURITY UPDATE: Prevent running the Ruby interpreter with an\n     attacker-controlled RUBYLIB environment variable\n     - debian/patches/CVE-2024-11003.patch, debian/control: drop usage of\n       Module::ScanDeps to prevent LPE\n     - CVE-2024-11003","status":"published","published":"2024-12-12T18:27:43Z","modified":"2026-06-04T10:03:25.198473Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2026-1778933429","title":"Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992","description":"   * SECURITY UPDATE: drop usage of Module::ScanDeps to prevent LPE\n     - debian/patches/CVE-2024-11003.patch: drop usage of Module::ScanDeps to prevent LPE\n     - CVE-2024-11003\n   * SECURITY UPDATE: do not set PYTHONPATH environment variable to prevent a LPE\n     - debian/patches/CVE-2024-48990.patch: do not set PYTHONPATH environment variable to prevent a LPE\n     - CVE-2024-48990\n   * SECURITY UPDATE: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression\n     - debian/patches/CVE-2024-48991.patch: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression\n     - CVE-2024-48991\n   * SECURITY UPDATE: do not set RUBYLIB environment variable to prevent a LPE\n     - debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE\n     - CVE-2024-48992","status":"published","published":"2026-05-16T12:10:34Z","modified":"2026-06-04T10:03:14.157763Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-3957-1","title":"needrestart - security update","status":"published","published":"2024-11-19T00:00:00Z","modified":"2026-03-09T01:21:37.79107Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5815-1","title":"needrestart - security update","status":"published","published":"2024-11-19T00:00:00Z","modified":"2026-03-09T02:09:56.670791Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"USN-7117-1","title":"Several security issues were fixed in needrestart and Module::ScanDeps","description":"Qualys discovered that needrestart passed unsanitized data to a library \n(libmodule-scandeps-perl) which expects safe input. A local attacker could\npossibly use this issue to execute arbitrary code as root.\n(CVE-2024-11003)\n\nQualys discovered that the library libmodule-scandeps-perl incorrectly \nparsed perl code. This could allow a local attacker to execute arbitrary\nshell commands. (CVE-2024-10224)\n\nQualys discovered that needrestart incorrectly used the PYTHONPATH \nenvironment variable to spawn a new Python interpreter. A local attacker \ncould possibly use this issue to execute arbitrary code as root. \n(CVE-2024-48990)\n\nQualys discovered that needrestart incorrectly checked the path to the\nPython interpreter. A local attacker could possibly use this issue to win\na race condition and execute arbitrary code as root. (CVE-2024-48991)\n\nQualys discovered that needrestart incorrectly used the RUBYLIB\nenvironment variable to spawn a new Ruby interpreter. A local attacker\ncould possibly use this issue to execute arbitrary code as root.\n(CVE-2024-48992)\n\n","status":"published","published":"2024-11-19T17:54:48Z","modified":"2026-06-25T13:32:30.173916018Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}