CVE-2024-8037

Description

Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.

Reserved 2024-08-21 | Published 2024-10-02 | Updated 2024-11-01 | Assigner canonical

Product status

3.5 before 3.5.4
affected

3.4 before 3.4.6
affected

3.3 before 3.3.7
affected

3.1 before 3.1.10
affected

2.9 before 2.9.51
affected

Credits

Pedro Guimaraes finder

Harry Pidcock remediation developer

Mark Esler coordinator

References

github.com/juju/juju/security/advisories/GHSA-8v4w-f4r9-7h6x issue-tracking

www.cve.org/CVERecord?id=CVE-2024-8037 issue-tracking

cve.org (CVE-2024-8037)

nvd.nist.gov (CVE-2024-8037)

Download JSON