CVE-2024-10224

Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().

References

Affected packages

Alpine:v3.21 / perl-module-scandeps

Package

Name: perl-module-scandeps
Purl: pkg:apk/alpine/perl-module-scandeps?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.37-r0

Alpine:v3.22 / perl-module-scandeps

Package

Name: perl-module-scandeps
Purl: pkg:apk/alpine/perl-module-scandeps?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.37-r0

Debian:11 / libmodule-scandeps-perl

Package

Name: libmodule-scandeps-perl
Purl: pkg:deb/debian/libmodule-scandeps-perl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.30-1+deb11u1

Affected versions

1.*

1.30-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / libmodule-scandeps-perl

Package

Name: libmodule-scandeps-perl
Purl: pkg:deb/debian/libmodule-scandeps-perl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.31-2+deb12u1

Affected versions

1.*

1.31-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / libmodule-scandeps-perl

Package

Name: libmodule-scandeps-perl
Purl: pkg:deb/debian/libmodule-scandeps-perl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.35-2

Affected versions

1.*

1.31-2

1.34-1

1.35-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}