Vulnerability · Published Oct 2, 2024 · Assigned by canonical
CVE-2024-8037
Medium 6.5
In plain English
A medium-severity incorrect default permissions in Juju from Canonical Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/juju/juju | 0.0.0-20240820065804-2f2ec128ef5a | GHSA-8v4w-f4r9-7h6x |
| Go | github.com/juju/juju | 0.0.0-20240820065804-2f2ec128ef5a | GO-2024-3174 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical Ltd. | Juju | 3.5 – before 3.5.43.4 – before 3.4.63.3 – before 3.3.73.1 – before 3.1.102.9 – before 2.9.51 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
References
- https://github.com/juju/juju/security/advisories/GHSA-8v4w-f4r9-7h6x issue-tracking
- https://www.cve.org/CVERecord?id=CVE-2024-8037 issue-tracking