| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/juju/juju | < 0.0.0-20240829052008-43f0fc59790dall versions | 0.0.0-20240829052008-43f0fc59790d |
| juju | ≥ 3.1.0, < 3.1.10≥ 3.2.0, ≤ 3.2.4≥ 3.3, < 3.3.7≥ 3.4, < 3.4.6≥ 3.5.0, < 3.5.4< 2.9.51 | 3.1.103.3.73.4.63.5.42.9.51 |
An abstract UNIX domain socket responsible for introspection is available without authentication locally to any user with access to the network namespace where the local juju agent is running.
On a juju controller agent, denial of service can be performed by using the /leases/revoke endpoint. Revoking leases in juju can cause availability issues.
On a juju machine agent that is hosting units, disabling the unit component can be performed using the /units endpoint with a "stop" action.
Patch: https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b Patched in:
No workaround.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free