CVE-2022-30688
First published: Tue May 17 2022(Updated: )
needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Needrestart Project Needrestart | >=0.8<3.6 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| debian/needrestart | 3.4-5+deb10u1 3.5-4+deb11u3 3.5-4+deb11u1 3.6-4 3.6-5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2022/05/17/9
- https://github.com/liske/needrestart/commit/e6e58136e1e3c92296e2e810cb8372a5fe0dbd30
- https://github.com/liske/needrestart/releases/tag/v3.6
- https://lists.debian.org/debian-lts-announce/2022/05/msg00024.html
- https://lists.debian.org/debian-security-announce/2022/msg00105.html
- https://www.debian.org/security/2022/dsa-5137
- https://www.openwall.com/lists/oss-security/2022/05/17/9
- https://security-tracker.debian.org/tracker/CVE-2022-30688
Frequently Asked Questions
What is CVE-2022-30688?
CVE-2022-30688 is a vulnerability in needrestart 0.8 through 3.5 before 3.6 that allows a local user to escalate privileges.
How does CVE-2022-30688 affect needrestart?
CVE-2022-30688 affects needrestart versions 0.8 through 3.5 before 3.6 by not anchoring the regexes used to detect the Perl, Python, and Ruby interpreters, allowing local privilege escalation.
Which software versions are affected by CVE-2022-30688?
needrestart versions 0.8 through 3.5 before 3.6, as well as Debian Linux versions 9.0, 10.0, and 11.0, are affected by CVE-2022-30688.
What is the severity of CVE-2022-30688?
CVE-2022-30688 has a severity score of 7.8, which is considered high.
How can I fix CVE-2022-30688?
To fix CVE-2022-30688, it is recommended to update to needrestart version 3.6 or higher.
- collector/nvd-api
- collector/nvd-index
- collector/security-tracker-debian
- agent/type
- vendor/needrestart project
- canonical/needrestart project needrestart
- version/needrestart project needrestart/0.8
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- package-manager/debian