CVE-2024-10224: OS Command Injection
Last updated 19 November 2024
Other sources
Qualys discovered that if unsanitized input was used with the library Modules: ScanDeps
— Microsoft
Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.35-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.35-2 - Upgrade
Upgrade
alpine/perl-module-scandepsto a version that resolves this vulnerability.Fixed in 1.37-r0 - Upgrade
Upgrade
debian/libmodule-scandeps-perlto a version that resolves this vulnerability.Fixed in 1.31-2+deb12u1 - Upgrade
Upgrade
debian/libmodule-scandeps-perlto a version that resolves this vulnerability.Fixed in 1.35-2 - Upgrade
Upgrade
debian/libmodule-scandeps-perlto a version that resolves this vulnerability.Fixed in 1.31-2+deb12u1Fixed in 1.37-1 - Upgrade
Upgrade
Modules::ScanDepsto a version that resolves this vulnerability.Fixed in 1.36
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10224?
CVE-2024-10224 has a high severity rating due to its potential to allow arbitrary command execution by local attackers.
How do I fix CVE-2024-10224?
To fix CVE-2024-10224, upgrade the libmodule-scandeps-perl package to version 1.36 or later.
Who is affected by CVE-2024-10224?
CVE-2024-10224 affects users of the libmodule-scandeps-perl package versions up to 1.35.
What are the potential impacts of CVE-2024-10224?
The potential impacts of CVE-2024-10224 include unauthorized execution of shell commands leading to system compromise.
What input is exploited in CVE-2024-10224?
CVE-2024-10224 is exploited via unsanitized input, specifically through methods that allow passing arbitrary command strings.