ghsa-xwgj-vpm9-q2rq
Vulnerability from github
Published
2024-10-03 16:53
Modified
2024-10-09 22:49
Severity ?
7.9 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
6.2 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:H
6.2 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:H
VLAI Severity ?
Summary
Vulnerable juju introspection abstract UNIX domain socket
Details
Impact
An abstract UNIX domain socket responsible for introspection is available without authentication locally to any user with access to the network namespace where the local juju agent is running.
On a juju controller agent, denial of service can be performed by using the /leases/revoke
endpoint. Revoking leases in juju can cause availability issues.
On a juju machine agent that is hosting units, disabling the unit component can be performed using the /units
endpoint with a "stop" action.
Patches
Patch: https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b Patched in: - 3.5.4 - 3.4.6 - 3.3.7 - 3.1.10 - 2.9.51
Workarounds
No workaround.
References
https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/introspection/worker.go#L125
{ "affected": [ { "package": { "ecosystem": "Go", "name": "github.com/juju/juju" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.0.0-20240829052008-43f0fc59790d" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2024-8038" ], "database_specific": { "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2024-10-03T16:53:26Z", "nvd_published_at": null, "severity": "MODERATE" }, "details": "### Impact\nAn abstract UNIX domain socket responsible for introspection is available without authentication locally to any user with access to the network namespace where the local juju agent is running.\n\nOn a juju controller agent, denial of service can be performed by using the `/leases/revoke` endpoint. Revoking leases in juju can cause availability issues.\n\nOn a juju machine agent that is hosting units, disabling the unit component can be performed using the `/units` endpoint with a \"stop\" action.\n\n### Patches\nPatch: https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b\nPatched in:\n- 3.5.4\n- 3.4.6\n- 3.3.7\n- 3.1.10\n- 2.9.51\n\n### Workarounds\nNo workaround.\n\n### References\nhttps://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/introspection/worker.go#L125\n", "id": "GHSA-xwgj-vpm9-q2rq", "modified": "2024-10-09T22:49:20Z", "published": "2024-10-03T16:53:26Z", "references": [ { "type": "WEB", "url": "https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8038" }, { "type": "WEB", "url": "https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b" }, { "type": "PACKAGE", "url": "https://github.com/juju/juju" }, { "type": "WEB", "url": "https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/introspection/worker.go#L125" }, { "type": "WEB", "url": "https://pkg.go.dev/vuln/GO-2024-3175" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:H", "type": "CVSS_V4" } ], "summary": "Vulnerable juju introspection abstract UNIX domain socket" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…