netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-8c64-q78q-87r6
GHSA-6vjm-54vp-mxhx
GHSA-8c64-q78q-87r6
This commit is contained in:
advisory-database[bot]
2024-08-05 17:20:05 +00:00
parent 9fc7d78f37
commit c66744afe3
3 changed files with 217 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json
+70
View File
@@ -0,0 +1,70 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8c64-q78q-87r6",
"modified": "2024-08-05T17:18:32Z",
"published": "2024-07-29T15:30:38Z",
"withdrawn": "2024-08-05T17:18:32Z",
"aliases": [
],
"summary": "Duplicate Advisory: Juju leaks of the sensitive context ID",
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6vjm-54vp-mxhx. This link has been maintained to preserve external references.\n\n## Original Description\n\nAn issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/juju/juju"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.50"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6984"
},
{
"type": "WEB",
"url": "https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2"
},
{
"type": "PACKAGE",
"url": "https://github.com/juju/juju"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6984"
}
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-08-05T17:18:32Z",
"nvd_published_at": "2024-07-29T14:15:04Z"
}
}
advisories/github-reviewed/2024/08/GHSA-6vjm-54vp-mxhx/GHSA-6vjm-54vp-mxhx.json
+147
View File
@@ -0,0 +1,147 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6vjm-54vp-mxhx",
"modified": "2024-08-05T17:19:11Z",
"published": "2024-08-05T17:19:11Z",
"aliases": [
],
"summary": "Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm",
"details": "An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm. A potential exploit where a user can run a bash loop attempting to execute hook tools. If running while another hook is executing, we log an error with the context ID, making it possible for the user to then use that ID in a following call successfully. This means an unprivileged user can access anything available via a hook tool such as config, relation data and secrets.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/juju/juju"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.50"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/juju/juju"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/juju/juju"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2.0"
},
{
"fixed": "3.3.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/juju/juju"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4.0"
},
{
"fixed": "3.4.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/juju/juju"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.5.0"
},
{
"fixed": "3.5.3"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6984"
},
{
"type": "WEB",
"url": "https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2"
},
{
"type": "PACKAGE",
"url": "https://github.com/juju/juju"
}
],
"database_specific": {
"cwe_ids": [
"CWE-209",
"CWE-269",
"CWE-284"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-08-05T17:19:11Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8c64-q78q-87r6",
"modified": "2024-07-29T15:30:39Z",
"published": "2024-07-29T15:30:38Z",
"aliases": [
"CVE-2024-6984"
],
"details": "An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "WEB",
"url": "https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6984"
},
{
"type": "WEB",
"url": "https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6984"
}
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T14:15:04Z"
}
}