Vulnerability · Published Oct 2, 2024 · Assigned by canonical
CVE-2024-8038
High 7.9
In plain English
A high-severity security flaw in Juju from Canonical Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.9High
Exploit odds (30 days)0.2%top 88.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/juju/juju | 0.0.0-20240829052008-43f0fc59790d | GHSA-xwgj-vpm9-q2rq |
| Go | github.com/juju/juju | no fix listed | GO-2024-3175 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical Ltd. | Juju | 3.5 – before 3.5.43.4 – before 3.4.63.3 – before 3.3.73.1 – before 3.1.102.9 – before 2.9.51 |
Weakness: CWE-420 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
References
- https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq issue-tracking
- https://www.cve.org/CVERecord?id=CVE-2024-8038 issue-tracking