CVE-2024-48990

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the…

High · published November 19, 2024

CVSS v3.1

7.8

EPSS

21%

Percentile

97.6

In the wild

Unconfirmed

What it is

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

The record

Technical detail

CVSS v3.1: 7.8 · HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.21269 · 97.6th percentile
Published: 2024-11-19T17:38Z

EPSS history

Timeline

19 NOV 17:38Z
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the…
cvelistv5