Amazon Linux 2 Security Advisory: ALAS-2025-2738
Advisory Release Date: 2025-01-21 20:25 Pacific
Advisory Updated Date: 2025-01-24 11:38 Pacific
Severity:
Medium
Issue Overview:
Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval(). (CVE-2024-10224)
Affected Packages:
perl-Module-ScanDeps
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update perl-Module-ScanDeps to update your system.
New Packages:
noarch:
perl-Module-ScanDeps-1.10-3.amzn2.0.1.noarch
src:
perl-Module-ScanDeps-1.10-3.amzn2.0.1.src