CVSS 3.1
6.5 mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:HCVE-2024-8037
Medium (6.5) in canonical juju. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/juju/juju 0.0.0-20240820065804-2f2ec128ef5a.
Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-31)
- CWE
- CWE-276
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:juju
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8v4w-f4r9-7h6x | Go | github.com/juju/juju | <0.0.0-20240820065804-2f2ec128ef5a | 0.0.0-20240820065804-2f2ec128ef5a |
| GO-2024-3174 | Go | github.com/juju/juju | <0.0.0-20240820065804-2f2ec128ef5a | 0.0.0-20240820065804-2f2ec128ef5a |