Key Information Vulnerability ID CVE-2024-48990 Publication and Update Dates Published: 2024-11-19 Updated: 2024-11-19 Description Qualys discovered that needrestart (prior to version 3.8) allows local attackers to execute arbitrary code by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable. CVSS Score Score: 7.8 Severity: HIGH Version: 3.1 Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Product Status Vendor: needrestart Product: needrestart Platforms: Linux Affected Versions Default Status: unknown Affected Versions: from before 0 to 3.8 Credit Qualys: finder Thomas Liske: remediation developer Mark Esler: coordinator References https://www.cve.org/CVERecord?id=CVE-2024-48990 https://github.com/liske/needrestart/commit/fcc9a4401392231bef4ef5ed026a0d7a275149ab https://www.qualys.com/2024/11/19/needrestart/needrestart.txt Authorized Data Publisher CISA-ADP