Juju uses a UNIX domain socket without setting appropriate permissions

CRITICAL 9.8CVE-2017-9232 · GHSA-j3hp-pv6v-rgrx · GO-2025-3639 · Published 28/05/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/juju/juju Go	`< 0.0.0-20170524231039-0417178a3c28`	`0.0.0-20170524231039-0417178a3c28`
juju canonical	`= 2.0.0= 2.0.1= 2.0.2= 2.0.3= 2.1.0= 2.1.1= 2.1.2≤ 1.25.12`	No fix yet

Description

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

NVD description

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

References

nvd.nist.gov/vuln/detail/CVE-2017-9232 · ADVISORY
juju/juju commit 0417178 · WEB
bugs.launchpad.net/juju/+bug/1682411 · WEB
juju/juju · PACKAGE
exploit-db.com/exploits/44023 · WEB
securityfocus.com/bid/98737 · Third Party Advisory
exploit-db.com/exploits/44023
GitHub Advisory GHSA-j3hp-pv6v-rgrx · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free