CVE-2024-48990

Name of the Vulnerable Software and Affected Versions needrestart versions prior to 3.8 Module::ScanDeps versions prior to 3.8

Description The needrestart utility, versions prior to 3.8, contains a flaw due to improper handling of the PYTHONPATH environment variable. This allows local attackers to execute arbitrary code with root privileges by manipulating the PYTHONPATH during Python interpreter initialization. The vulnerability stems from an uncontrolled search path element. A publicly available exploit exists for this issue. The vulnerability affects systems running Ubuntu and Debian.

Recommendations Upgrade needrestart to version 3.8 or later. Upgrade Module::ScanDeps to version 3.8 or later.