Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().
References
| Link | Resource |
|---|---|
| https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529 | Exploit Vendor Advisory |
| https://www.cve.org/CVERecord?id=CVE-2024-10224 | Third Party Advisory |
| https://www.qualys.com/2024/11/19/needrestart/needrestart.txt | Exploit Mitigation |
| https://lists.debian.org/debian-lts-announce/2024/11/msg00015.html | Mailing List |
| https://www.openwall.com/lists/oss-security/2024/11/19/1 | Exploit Mailing List Mitigation |
Configurations
History
26 Aug 2025, 17:36
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Rschupp modules\
Rschupp Debian debian Linux Debian |
|
| CPE | cpe:2.3:a:rschupp:modules\:\:scandeps:*:*:*:*:*:perl:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
|
| References | () https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529 - Exploit, Vendor Advisory | |
| References | () https://www.cve.org/CVERecord?id=CVE-2024-10224 - Third Party Advisory | |
| References | () https://www.qualys.com/2024/11/19/needrestart/needrestart.txt - Exploit, Mitigation | |
| References | () https://lists.debian.org/debian-lts-announce/2024/11/msg00015.html - Mailing List | |
| References | () https://www.openwall.com/lists/oss-security/2024/11/19/1 - Exploit, Mailing List, Mitigation |
Information
Published : 2024-11-19 18:15
Updated : 2025-08-26 17:36
NVD link : CVE-2024-10224
Mitre link : CVE-2024-10224
CVE.ORG link : CVE-2024-10224
JSON object : View
Products Affected
rschupp
- modules\
debian
- debian_linux
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')