🛡️ USN-7117-3 — needrestart (CVE-2024-11003 +4 more)

needrestart regression

USN-7117-1 fixed vulnerabilities in needrestart. The update introduced a

regression in needrestart. This update fixes the problem for LXC

containers.

We apologize for the inconvenience.

Original advisory details:

Qualys discovered that needrestart passed unsanitized data to a library

(libmodule-scandeps-perl) which expects safe input. A local attacker could

possibly use this issue to execute arbitrary code as root.

(CVE-2024-11003)

Qualys discovered that the library libmodule-scandeps-perl incorrectly

parsed perl code. This could allow a local attacker to execute arbitrary

shell commands. (CVE-2024-10224)

Qualys discovered that needrestart incorrectly used the PYTHONPATH

environment variable to spawn a new Python interpreter. A local attacker

could possibly use this issue to execute arbitrary code as root.

(CVE-2024-48990)

Qualys discovered that needrestart incorrectly checked the path to the

Python interpreter. A local attacker could possibly use this issue to win

a race condition and execute arbitrary code as root. (CVE-2024-48991)

Qualys discovered that needrestart incorrectly used the RUBYLIB

environment variable to spawn a new Ruby interpreter. A local attacker

could possibly use this issue to execute arbitrary code as root.

(CVE-2024-48992)