GHSA-85qf-6845-m8p2

Source

https://github.com/advisories/GHSA-85qf-6845-m8p2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-85qf-6845-m8p2/GHSA-85qf-6845-m8p2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-85qf-6845-m8p2

Withdrawn

2024-10-02T21:55:50Z

Published

2024-10-02T12:30:33Z

Modified

2024-10-02T21:55:50Z

Severity

7.9 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H CVSS Calculator

Summary

Duplicate Advisory: Juju Unprotected Alternate Channel vulnerability

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-xwgj-vpm9-q2rq. This link is maintained to preserve external references.

Original Description

Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.

Database specific

{
    "cwe_ids": [
        "CWE-420"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-02T21:55:50Z",
    "nvd_published_at": "2024-10-02T11:15:11Z",
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/juju/juju

Package

Name: github.com/juju/juju; View open source insights on deps.dev
Purl: pkg:golang/github.com/juju/juju

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20241001032836-2af7bd8e310b

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-85qf-6845-m8p2/GHSA-85qf-6845-m8p2.json"