{"id":"CVE-2024-48990","aliases":["CLSA-2024-1734028058","CLSA-2026-1778933429","DEBIAN-CVE-2024-48990","DLA-3957-1","DSA-5815-1","EUVD-2024-43193","GHSA-7c65-3hqv-hvmm","UBUNTU-CVE-2024-48990","USN-7117-1"],"status":"published","title":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.29202,"percentile":0.98186,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-427"],"published":"2024-11-19T00:00:00Z","modified":"2026-11-02T12:03:04Z","exploits":[{"source":"metasploit","id":"exploit/linux/local/ubuntu_needrestart_lpe","title":"Ubuntu needrestart Privilege Escalation","type":"exploit","platform":"Linux","date":"2024-11-19","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/local/ubuntu_needrestart_lpe"},{"source":"pocgithub","id":"makuga01/CVE-2024-48990-PoC","title":"makuga01/CVE-2024-48990-PoC","date":"2024-11-20","url":"https://github.com/makuga01/CVE-2024-48990-PoC"},{"source":"pocgithub","id":"ns989/CVE-2024-48990","title":"ns989/CVE-2024-48990","date":"2024-11-21","url":"https://github.com/ns989/CVE-2024-48990"},{"source":"pocgithub","id":"felmoltor/CVE-2024-48990","title":"felmoltor/CVE-2024-48990","date":"2024-11-22","url":"https://github.com/felmoltor/CVE-2024-48990"},{"source":"pocgithub","id":"Cyb3rFr0g/CVE-2024-48990-PoC","title":"Cyb3rFr0g/CVE-2024-48990-PoC","date":"2024-11-24","url":"https://github.com/Cyb3rFr0g/CVE-2024-48990-PoC"},{"source":"pocgithub","id":"pentestfunctions/CVE-2024-48990-PoC-Testing","title":"pentestfunctions/CVE-2024-48990-PoC-Testing","date":"2024-11-24","url":"https://github.com/pentestfunctions/CVE-2024-48990-PoC-Testing"},{"source":"pocgithub","id":"ally-petitt/CVE-2024-48990-Exploit","title":"ally-petitt/CVE-2024-48990-Exploit","date":"2024-11-25","url":"https://github.com/ally-petitt/CVE-2024-48990-Exploit"},{"source":"pocgithub","id":"CyberCrowCC/CVE-2024-48990","title":"CyberCrowCC/CVE-2024-48990","date":"2024-12-09","url":"https://github.com/CyberCrowCC/CVE-2024-48990"},{"source":"pocgithub","id":"NullByte-7w7/CVE-2024-48990","title":"NullByte-7w7/CVE-2024-48990","date":"2024-12-18","url":"https://github.com/NullByte-7w7/CVE-2024-48990"},{"source":"pocgithub","id":"Serner77/CVE-2024-48990-Automatic-Exploit","title":"Serner77/CVE-2024-48990-Automatic-Exploit","date":"2025-10-28","url":"https://github.com/Serner77/CVE-2024-48990-Automatic-Exploit"},{"source":"pocgithub","id":"mladicstefan/CVE-2024-48990","title":"mladicstefan/CVE-2024-48990","date":"2025-10-28","url":"https://github.com/mladicstefan/CVE-2024-48990"},{"source":"pocgithub","id":"Mr-DJ/CVE-2024-48990","title":"Mr-DJ/CVE-2024-48990","date":"2025-10-30","url":"https://github.com/Mr-DJ/CVE-2024-48990"},{"source":"pocgithub","id":"Loaxert/CVE-2024-48990-PoC","title":"Loaxert/CVE-2024-48990-PoC","date":"2025-10-31","url":"https://github.com/Loaxert/CVE-2024-48990-PoC"},{"source":"pocgithub","id":"endermixxer/CVE-2024-48990_needrestart","title":"endermixxer/CVE-2024-48990_needrestart","date":"2025-11-11","url":"https://github.com/endermixxer/CVE-2024-48990_needrestart"},{"source":"pocgithub","id":"nekr0ff/needrestart-sudo-escalate-cve-2024-48990","title":"nekr0ff/needrestart-sudo-escalate-cve-2024-48990","date":"2025-11-12","url":"https://github.com/nekr0ff/needrestart-sudo-escalate-cve-2024-48990"},{"source":"pocgithub","id":"0x3bs/CVE-2024-48990","title":"0x3bs/CVE-2024-48990","date":"2025-12-01","url":"https://github.com/0x3bs/CVE-2024-48990"},{"source":"pocgithub","id":"o-sec/CVE-2024-48990","title":"o-sec/CVE-2024-48990","date":"2025-12-16","url":"https://github.com/o-sec/CVE-2024-48990"},{"source":"pocgithub","id":"sobbing333/CVE-2024-48990-POC","title":"sobbing333/CVE-2024-48990-POC","date":"2025-12-21","url":"https://github.com/sobbing333/CVE-2024-48990-POC"},{"source":"pocgithub","id":"grecosamuel/CVE-2024-48990","title":"grecosamuel/CVE-2024-48990","date":"2025-12-22","url":"https://github.com/grecosamuel/CVE-2024-48990"},{"source":"pocgithub","id":"BLUEBERRYP1LL/CVE-2024-48990","title":"BLUEBERRYP1LL/CVE-2024-48990","date":"2026-02-13","url":"https://github.com/BLUEBERRYP1LL/CVE-2024-48990"}],"fixes":[{"ecosystem":"Debian:12","package":"needrestart","fixed_in":["3.6-4+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"needrestart","fixed_in":["3.7-3.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"needrestart","fixed_in":["3.7-3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","fixed_in":["2.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","fixed_in":["3.1-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","fixed_in":["3.4-6ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","fixed_in":["3.5-5ubuntu2.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","fixed_in":["3.6-7ubuntu4.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-4+deb12u2"}]}],"versions":["3.6-4","3.6-4+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-3.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-3.1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-4+deb11u4"}]}],"versions":["3.5-4","3.5-4+deb11u1","3.5-4+deb11u2","3.5-4+deb11u3"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-4+deb12u2"}]}],"versions":["3.6-4","3.6-4+deb12u1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1ubuntu0.1~esm1"}]}],"versions":["2.1-1","2.3-2","2.4-1","2.5-1","2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+esm1"}]}],"versions":["2.11-4","3.0-1","3.1-1","3.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+esm1"}]}],"versions":["3.4-5","3.4-6","3.4-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-5ubuntu2.2"}]}],"versions":["3.5-4ubuntu2","3.5-5ubuntu1","3.5-5ubuntu2","3.5-5ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-7ubuntu4.3"}]}],"versions":["3.6-5","3.6-6","3.6-7","3.6-7ubuntu3","3.6-7ubuntu4","3.6-7ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-1ubuntu0.1~esm1"}]}],"versions":["1.19-1","1.20-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1ubuntu0.1~esm1"}]}],"versions":["2.1-1","2.3-2","2.4-1","2.5-1","2.6-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-1ubuntu0.1~esm1"}]}],"versions":["1.23-1","1.24-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1ubuntu0.1+esm1"}]}],"versions":["2.11-4","3.0-1","3.1-1","3.1-1ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1ubuntu0.1~esm1"}]}],"versions":["1.27-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-6ubuntu0.1+esm1"}]}],"versions":["3.4-5","3.4-6","3.4-6ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31-1ubuntu0.1"}]}],"versions":["1.30-1","1.31-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-5ubuntu2.2"}]}],"versions":["3.5-4ubuntu2","3.5-5ubuntu1","3.5-5ubuntu2","3.5-5ubuntu2.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libmodule-scandeps-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-1ubuntu0.24.04.1"}]}],"versions":["1.31-2","1.34-1","1.35-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"needrestart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-7ubuntu4.3"}]}],"versions":["3.6-5","3.6-6","3.6-7","3.6-7ubuntu3","3.6-7ubuntu4","3.6-7ubuntu4.1"],"bundled":5}],"products":[{"vendor":"needrestart","product":"needrestart"},{"vendor":"needrestart_project","product":"needrestart"}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2024-48990","tags":["issue-tracking","VDB Entry","report"]},{"url":"https://github.com/liske/needrestart/commit/fcc9a4401392231bef4ef5ed026a0d7a275149ab","tags":["patch","Patch","fix"]},{"url":"https://www.qualys.com/2024/11/19/needrestart/needrestart.txt","tags":["third-party-advisory","Third Party Advisory","advisory","report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/11/19/1","tags":["Mailing List","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/17","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48990","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7c65-3hqv-hvmm"},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1734028058.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1778933429.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48990.json","tags":["advisory"]},{"url":"https://github.com/liske/needrestart","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-48990","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-48990","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7117-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-10224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-11003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48992","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-48990","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.","status":"published","published":"2024-11-19T17:38:07.238Z","modified":"2025-11-03T22:22:08.006Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:34:11.97482Z"}],"euvd":[{"id":"EUVD-2024-43193","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.","status":"published","published":"2024-11-19T17:38:07Z","modified":"2025-11-03T22:22:08Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-7c65-3hqv-hvmm","title":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute...","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.","status":"published","published":"2024-11-19T18:31:06Z","modified":"2025-11-04T00:32:06Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:04:30.667422Z"}],"nvd":[{"id":"CVE-2024-48990","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.","status":"published","published":"2024-11-19T18:15:21.53Z","modified":"2026-06-17T07:59:11.79Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:10:37.632431Z"}],"osv":[{"id":"CVE-2024-48990","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.","status":"published","published":"2024-11-19T17:38:07.238Z","modified":"2026-10-28T02:30:57.498748978Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"DEBIAN-CVE-2024-48990","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.","status":"published","published":"2024-11-19T18:15:21.53Z","modified":"2026-11-02T12:03:04.01508222Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"UBUNTU-CVE-2024-48990","description":"Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.","status":"published","published":"2024-11-19T16:00:00Z","modified":"2026-02-04T04:25:56.879243Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"CLSA-2024-1734028058","title":"Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992","description":"   * SECURITY UPDATE: Prevent running the Python interpreter with an\n     attacker-controlled PYTHONPATH environment variable\n     - debian/patches/CVE-2024-48990-CVE-2024-48991.patch: do not set\n       PYTHONPATH environment variable to prevent a LPE and prevent\n       race condition on /proc/$PID/exec evaluation\n     - CVE-2024-48990\n     - CVE-2024-48991\n   * SECURITY UPDATE: Prevent running the Ruby interpreter with an\n     attacker-controlled RUBYLIB environment variable\n     - debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment\n       variable to prevent a LPE\n     - CVE-2024-48992\n   * SECURITY UPDATE: Prevent running the Ruby interpreter with an\n     attacker-controlled RUBYLIB environment variable\n     - debian/patches/CVE-2024-11003.patch, debian/control: drop usage of\n       Module::ScanDeps to prevent LPE\n     - CVE-2024-11003","status":"published","published":"2024-12-12T18:27:43Z","modified":"2026-06-04T10:03:25.198473Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2026-1778933429","title":"Fix CVE(s): CVE-2024-11003, CVE-2024-48990, CVE-2024-48991, CVE-2024-48992","description":"   * SECURITY UPDATE: drop usage of Module::ScanDeps to prevent LPE\n     - debian/patches/CVE-2024-11003.patch: drop usage of Module::ScanDeps to prevent LPE\n     - CVE-2024-11003\n   * SECURITY UPDATE: do not set PYTHONPATH environment variable to prevent a LPE\n     - debian/patches/CVE-2024-48990.patch: do not set PYTHONPATH environment variable to prevent a LPE\n     - CVE-2024-48990\n   * SECURITY UPDATE: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression\n     - debian/patches/CVE-2024-48991.patch: prevent race condition on /proc/$PID/exec evaluation and fix chroot/mountns regression\n     - CVE-2024-48991\n   * SECURITY UPDATE: do not set RUBYLIB environment variable to prevent a LPE\n     - debian/patches/CVE-2024-48992.patch: do not set RUBYLIB environment variable to prevent a LPE\n     - CVE-2024-48992","status":"published","published":"2026-05-16T12:10:34Z","modified":"2026-06-04T10:03:14.157763Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-3957-1","title":"needrestart - security update","status":"published","published":"2024-11-19T00:00:00Z","modified":"2026-03-09T01:21:37.79107Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5815-1","title":"needrestart - security update","status":"published","published":"2024-11-19T00:00:00Z","modified":"2026-03-09T02:09:56.670791Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"USN-7117-1","title":"Several security issues were fixed in needrestart and Module::ScanDeps","description":"Qualys discovered that needrestart passed unsanitized data to a library \n(libmodule-scandeps-perl) which expects safe input. A local attacker could\npossibly use this issue to execute arbitrary code as root.\n(CVE-2024-11003)\n\nQualys discovered that the library libmodule-scandeps-perl incorrectly \nparsed perl code. This could allow a local attacker to execute arbitrary\nshell commands. (CVE-2024-10224)\n\nQualys discovered that needrestart incorrectly used the PYTHONPATH \nenvironment variable to spawn a new Python interpreter. A local attacker \ncould possibly use this issue to execute arbitrary code as root. \n(CVE-2024-48990)\n\nQualys discovered that needrestart incorrectly checked the path to the\nPython interpreter. A local attacker could possibly use this issue to win\na race condition and execute arbitrary code as root. (CVE-2024-48991)\n\nQualys discovered that needrestart incorrectly used the RUBYLIB\nenvironment variable to spawn a new Ruby interpreter. A local attacker\ncould possibly use this issue to execute arbitrary code as root.\n(CVE-2024-48992)\n\n","status":"published","published":"2024-11-19T17:54:48Z","modified":"2026-06-25T13:32:30.173916018Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}