GHSA-xwgj-vpm9-q2rq CVE-2024-8038 GO-2024-3175
Vulnerable juju introspection abstract UNIX domain socket
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.21%
- Chance of exploitation in the next 30 days. Higher than 11.49% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-420 Unprotected Alternate Channel
- Fix
0.0.0-20240829052008-43f0fc59790d- Upgrade github.com/juju/juju to this version or later
Description
Impact
An abstract UNIX domain socket responsible for introspection is available without authentication locally to any user with access to the network namespace where the local juju agent is running.
On a juju controller agent, denial of service can be performed by using the /leases/revoke endpoint. Revoking leases in juju can cause availability issues.
On a juju machine agent that is hosting units, disabling the unit component can be performed using the /units endpoint with a "stop" action.
Patches
Patch: https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b Patched in:
- 3.5.4
- 3.4.6
- 3.3.7
- 3.1.10
- 2.9.51
Workarounds
No workaround.
References
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/juju/juju | < 0.0.0-20240829052008-43f0fc59790d |
0.0.0-20240829052008-43f0fc59790d |
| github.com/juju/juju | all versions |
No fix yet |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/juju/juju Go → 0.0.0-20240829052008-43f0fc59790d
- go
go get github.com/juju/juju@v0.0.0-20240829052008-43f0fc59790d && go mod tidy
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:H
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- High
- Availability (subsequent systems)
- High
CVSS 3.1 7.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Weakness
CWE-420: Unprotected Alternate Channel
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
How to prevent it
- Architecture and Design: Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7m55-2hr4-pw78 Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence | Medium | Also affects github.com/juju/juju |
| GHSA-w5fq-8965-c969 Juju: CloudSpec method leaking cloud credentials | Medium | Also affects github.com/juju/juju |
| GHSA-245v-p8fj-vwm2 Juju has a resource poisoning vulnerability | Medium | Also affects github.com/juju/juju |
| GHSA-j6f6-jp3p-53mw Juju: Read All Controller Logs From Compromised Workload | Medium | Also affects github.com/juju/juju |
| GHSA-gvrj-cjch-728p Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster | Critical | Also affects github.com/juju/juju |
| GHSA-5cj2-rqqf-hx9p Juju affected by Confused Deputy IDOR attack via Predictable user specified ID in Juju Secrets | Medium | Also affects github.com/juju/juju |
| GHSA-439w-v2p7-pggc Juju has unauthorized access to out-of-scope Kubernetes secrets | High | Also affects github.com/juju/juju |
| GHSA-89x7-5m5m-mcmm Juju has unauthorized update of out-of-scope Vault secrets | Medium | Also affects github.com/juju/juju |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor