CVE-2024-48990

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running...

Original description

The description as published by the source.

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2024-48990 needrestart Fixed in: 3.5-4+deb11u4

References

advisory github.com
advisory nvd.nist.gov
advisory qualys.com
package github.com
patch github.com
report cve.org
web seclists.org
web lists.debian.org
web openwall.com