PT-2024-8536 · Unknown+7 · Modules::Scandeps+7

Mark Esler + 3 · Published 2024-11-19 · Updated 2025-12-23 · CVE-2024-10224

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Modules::ScanDeps versions prior to 1.36

Description The issue is related to the Modules::ScanDeps library, which does not properly sanitize input. This can allow an attacker to execute arbitrary shell commands. A local attacker could exploit this by passing unsanitized input to the library, potentially allowing them to run commands as root.

Recommendations For versions prior to 1.36, update to version 1.36 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Modules::ScanDeps library until a patch is applied. Avoid using unsanitized input with the library to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALSA-2025:7350

AZL-53394

AZL-53397

BDU:2024-10103

CVE-2024-10224

DLA-3958-1

DSA-5816-1

GHSA-G597-359Q-V529

INFSA-2025_7350

OESA-2024-2496

OPENSUSE-SU-2025:14635-1

RHSA-2025:7350

RHSA-2025_7350

USN-7117-1

USN-7117-2

USN-7117-3

Affected Products

Almalinux

Astra Linux

Linuxmint

Modules::Scandeps

Red Hat

Red Os

Rocky Linux

Ubuntu

References · 65

• 🔥 https://openwall.com/lists/oss-security/2024/11/19/1 · Exploit
• 🔥 https://qualys.com/2024/11/19/needrestart/needrestart.txt · Exploit
• https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10224 · Security Note
• https://osv.dev/vulnerability/USN-7117-3 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-53394 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2024-10224 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-10224 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14635-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7117-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-48991 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10103 · Security Note
• https://ubuntu.com/security/CVE-2024-48992 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-10224 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2025-7350.html · Vendor Advisory