Vulnerability · Published Nov 19, 2024 · Assigned by canonical
CVE-2024-10224
Medium 5.3
In plain English
A medium-severity OS command injection in Module::ScanDeps from Module::ScanDeps. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 9.0% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | perl-Module-ScanDeps | 1.30-6.el9 | ALSA-2025:7350 |
| Alpine:v3.21 | perl-module-scandeps | 1.37-r0 | ALPINE-CVE-2024-10224 |
| Alpine:v3.22 | perl-module-scandeps | 1.37-r0 | ALPINE-CVE-2024-10224 |
| Alpine:v3.23 | perl-module-scandeps | 1.37-r0 | ALPINE-CVE-2024-10224 |
| Alpine:v3.24 | perl-module-scandeps | 1.37-r0 | ALPINE-CVE-2024-10224 |
| Debian:12 | libmodule-scandeps-perl | 1.31-2+deb12u1 | DSA-5816-1 |
| Debian:12 | libmodule-scandeps-perl | 1.31-2+deb12u1 | DEBIAN-CVE-2024-10224 |
| Debian:13 | libmodule-scandeps-perl | 1.35-2 | DEBIAN-CVE-2024-10224 |
| Debian:14 | libmodule-scandeps-perl | 1.35-2 | DEBIAN-CVE-2024-10224 |
| Rocky Linux:9 | perl-Module-ScanDeps | 0:1.30-6.el9 | RLSA-2025:7350 |
| Ubuntu:22.04:LTS | libmodule-scandeps-perl | 1.31-1ubuntu0.1 | USN-7117-1 |
| Ubuntu:22.04:LTS | libmodule-scandeps-perl | 1.31-1ubuntu0.1 | UBUNTU-CVE-2024-10224 |
| Ubuntu:24.04:LTS | libmodule-scandeps-perl | 1.35-1ubuntu0.24.04.1 | UBUNTU-CVE-2024-10224 |
| Ubuntu:24.04:LTS | libmodule-scandeps-perl | 1.35-1ubuntu0.24.04.1 | USN-7117-1 |
| Ubuntu:22.04:LTS | needrestart | 3.5-5ubuntu2.2 | USN-7117-1 |
| Ubuntu:24.04:LTS | needrestart | 3.6-7ubuntu4.3 | USN-7117-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Module::ScanDeps | Module::ScanDeps | 0 – before 1.38 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- https://www.cve.org/CVERecord?id=CVE-2024-10224 issue-tracking
- https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529 vendor-advisory
- https://www.qualys.com/2024/11/19/needrestart/needrestart.txt third-party-advisory
- https://lists.debian.org/debian-lts-announce/2024/11/msg00015.html
- https://www.openwall.com/lists/oss-security/2024/11/19/1
- http://seclists.org/fulldisclosure/2024/Nov/17
- http://seclists.org/fulldisclosure/2024/Nov/15