diff --git a/advisories/github-reviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json b/advisories/github-reviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json new file mode 100644 index 00000000000..9b23df48f5d --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json @@ -0,0 +1,70 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8c64-q78q-87r6", + "modified": "2024-08-05T17:18:32Z", + "published": "2024-07-29T15:30:38Z", + "withdrawn": "2024-08-05T17:18:32Z", + "aliases": [ + + ], + "summary": "Duplicate Advisory: Juju leaks of the sensitive context ID", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6vjm-54vp-mxhx. This link has been maintained to preserve external references.\n\n## Original Description\n\nAn issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.50" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6984" + }, + { + "type": "WEB", + "url": "https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/juju/juju" + }, + { + "type": "WEB", + "url": "https://www.cve.org/CVERecord?id=CVE-2024-6984" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-209" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T17:18:32Z", + "nvd_published_at": "2024-07-29T14:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-6vjm-54vp-mxhx/GHSA-6vjm-54vp-mxhx.json b/advisories/github-reviewed/2024/08/GHSA-6vjm-54vp-mxhx/GHSA-6vjm-54vp-mxhx.json new file mode 100644 index 00000000000..57efa255b1a --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-6vjm-54vp-mxhx/GHSA-6vjm-54vp-mxhx.json @@ -0,0 +1,147 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6vjm-54vp-mxhx", + "modified": "2024-08-05T17:19:11Z", + "published": "2024-08-05T17:19:11Z", + "aliases": [ + + ], + "summary": "Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm", + "details": "An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm. A potential exploit where a user can run a bash loop attempting to execute hook tools. If running while another hook is executing, we log an error with the context ID, making it possible for the user to then use that ID in a following call successfully. This means an unprivileged user can access anything available via a hook tool such as config, relation data and secrets.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.50" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.1.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2.0" + }, + { + "fixed": "3.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4.0" + }, + { + "fixed": "3.4.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.5.0" + }, + { + "fixed": "3.5.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6984" + }, + { + "type": "WEB", + "url": "https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/juju/juju" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-209", + "CWE-269", + "CWE-284" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T17:19:11Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json b/advisories/unreviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json deleted file mode 100644 index f993e9fc978..00000000000 --- a/advisories/unreviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-8c64-q78q-87r6", - "modified": "2024-07-29T15:30:39Z", - "published": "2024-07-29T15:30:38Z", - "aliases": [ - "CVE-2024-6984" - ], - "details": "An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6984" - }, - { - "type": "WEB", - "url": "https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2" - }, - { - "type": "WEB", - "url": "https://www.cve.org/CVERecord?id=CVE-2024-6984" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-209" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-07-29T14:15:04Z" - } -} \ No newline at end of file