GHSA-fc27-7pf5-96v3

Source

https://github.com/advisories/GHSA-fc27-7pf5-96v3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-fc27-7pf5-96v3/GHSA-fc27-7pf5-96v3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fc27-7pf5-96v3

Withdrawn

2024-10-02T21:55:47Z

Published

2024-10-02T12:30:33Z

Modified

2024-10-02T21:55:47Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H CVSS Calculator

Summary

Duplicate Advisory: Vulnerable juju hook tool abstract UNIX domain socket

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-8v4w-f4r9-7h6x. This link is maintained to preserve external references.

Original Description

Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-10-02T21:55:47Z",
    "nvd_published_at":  "2024-10-02T11:15:11Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/juju/juju

Package

Name: github.com/juju/juju; View open source insights on deps.dev
Purl: pkg:golang/github.com/juju/juju

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20241001032836-2af7bd8e310b

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-fc27-7pf5-96v3/GHSA-fc27-7pf5-96v3.json"