Medium severity5.3NVD Advisory· Published Nov 19, 2024· Updated Jun 17, 2026
CVE-2024-10224
CVE-2024-10224
Description
Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- Range: <1.36
- osv-coords2 versionspkg:rpm/almalinux/perl-Module-ScanDepspkg:rpm/opensuse/perl-Module-ScanDeps&distro=openSUSE%20Tumbleweed
< 1.30-6.el9+ 1 more
- (no CPE)range: < 1.30-6.el9
- (no CPE)range: < 1.370.0-1.1
- Range: 0
Patches
Vulnerability mechanics
References
7- github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529nvdExploitVendor Advisory
- www.openwall.com/lists/oss-security/2024/11/19/1nvdExploitMailing ListMitigation
- www.qualys.com/2024/11/19/needrestart/needrestart.txtnvdExploitMitigation
- www.cve.org/CVERecordnvdThird Party Advisory
- lists.debian.org/debian-lts-announce/2024/11/msg00015.htmlnvdMailing List
- seclists.org/fulldisclosure/2024/Nov/15nvd
- seclists.org/fulldisclosure/2024/Nov/17nvd
News mentions
0No linked articles in our index yet.