CVE-2024-7558

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-7558
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7558.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-7558
Aliases
Downstream
Related
Published
2024-10-02T10:06:31.098Z
Modified
2026-08-12T03:51:45.125642855Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H CVSS Calculator
Summary
[none]
Details

JUJUCONTEXTID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJUCONTEXTID value. This gives the unprivileged user access to the same information and tools as the Juju charm.

Database specific 
{
    "cwe_ids": [
        "CWE-1391",
        "CWE-337",
        "CWE-340"
    ],
    "cna_assigner": "canonical",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7558.json"
}
References

Affected packages

Git / github.com/juju/juju

Affected ranges

Type
GIT
Repo
https://github.com/juju/juju
Events
Introduced
2da8de8a4fd4f5dbbed42c6e5c355a37649f1d22
Fixed
31b4b0914740b84ad8166993635ac797a44276de
Introduced
20a2e3972cb21b88ce8fdae7f54292da2e52aeff
Fixed
06aa5de95bf57f3cbbd33ea968a0bad85e561ee0
Introduced
6c24d578c38db28567c6774f7d51803b807a9c5d
Fixed
2634af3dab34358b2416e9d2d780c3c1b6e00d41
Introduced
07dba11f3e89a9196ac76e3fe388196b084b3e58
Fixed
0ef13a91b3cccff77f3fb8544a265c28ddfe3fe1
Introduced
ac860f7db4296273ea2cf213115ec2c229d57a07
Fixed
bc4db7b86800c81014d5c9ec1dabedbc99137596
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.5"
        },
        {
            "fixed": "3.5.4"
        },
        {
            "introduced": "3.4"
        },
        {
            "fixed": "3.4.6"
        },
        {
            "introduced": "3.3"
        },
        {
            "fixed": "3.3.7"
        },
        {
            "introduced": "3.1"
        },
        {
            "fixed": "3.1.10"
        },
        {
            "introduced": "2.9"
        },
        {
            "fixed": "2.9.51"
        }
    ]
}

Affected versions

Other
juju-
juju-2.*
juju-2.9.0
juju-2.9.1
juju-2.9.10
juju-2.9.11
juju-2.9.12
juju-2.9.13
juju-2.9.14
juju-2.9.15
juju-2.9.16
juju-2.9.17
juju-2.9.18
juju-2.9.19
juju-2.9.2
juju-2.9.20
juju-2.9.21
juju-2.9.22
juju-2.9.23
juju-2.9.24
juju-2.9.25
juju-2.9.26
juju-2.9.27
juju-2.9.28
juju-2.9.29
juju-2.9.3
juju-2.9.30
juju-2.9.31
juju-2.9.32
juju-2.9.33
juju-2.9.34
juju-2.9.35
juju-2.9.36
juju-2.9.37
juju-2.9.38
juju-2.9.39
juju-2.9.4
juju-2.9.40
juju-2.9.41
juju-2.9.42
juju-2.9.43
juju-2.9.44
juju-2.9.46
juju-2.9.5
juju-2.9.6
juju-2.9.7
juju-2.9.8
juju-2.9.9
juju-3.*
juju-3.2.4
juju-3.3.0
v2.*
v2.9.45
v2.9.46
v2.9.47
v2.9.48
v2.9.49
v3.*
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.4-beta1
v3.4-rc1
v3.4-rc2
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.5-beta1
v3.5-rc1
v3.5.0
v3.5.1
v3.5.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7558.json"