CVE-2022-30688

 

Published at: - 17-05-2022 09:15

Last modified: - 25-05-2022 08:30

Total changes: - 3

Description

needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://www.openwall.com/lists/oss-security/2022/05/17/9
• https://github.com/liske/needrestart/releases/tag/v3.6
• https://lists.debian.org/debian-security-announce/2022/msg00105.html
• https://github.com/liske/needrestart/commit/e6e58136e1e3c92296e2e810cb8372a5fe0dbd30
• [oss-security] 20220517 CVE-2022-30688: needrestart 0.8+ local privilege escalation-Mailing List, Third Party Advisory
• DSA-5137-Third Party Advisory
• [debian-lts-announce] 20220518 [SECURITY] [DLA 3013-1] needrestart security update-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2022-30688

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures