From c66744afe3037f071813dd2667bb6c8dfc7a262b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 5 Aug 2024 17:20:05 +0000 Subject: [PATCH] Publish Advisories GHSA-8c64-q78q-87r6 GHSA-6vjm-54vp-mxhx GHSA-8c64-q78q-87r6 --- .../GHSA-8c64-q78q-87r6.json | 70 +++++++++ .../GHSA-6vjm-54vp-mxhx.json | 147 ++++++++++++++++++ .../GHSA-8c64-q78q-87r6.json | 46 ------ 3 files changed, 217 insertions(+), 46 deletions(-) create mode 100644 advisories/github-reviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-6vjm-54vp-mxhx/GHSA-6vjm-54vp-mxhx.json delete mode 100644 advisories/unreviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json diff --git a/advisories/github-reviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json b/advisories/github-reviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json new file mode 100644 index 00000000000..9b23df48f5d --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json @@ -0,0 +1,70 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8c64-q78q-87r6", + "modified": "2024-08-05T17:18:32Z", + "published": "2024-07-29T15:30:38Z", + "withdrawn": "2024-08-05T17:18:32Z", + "aliases": [ + + ], + "summary": "Duplicate Advisory: Juju leaks of the sensitive context ID", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6vjm-54vp-mxhx. This link has been maintained to preserve external references.\n\n## Original Description\n\nAn issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.50" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6984" + }, + { + "type": "WEB", + "url": "https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/juju/juju" + }, + { + "type": "WEB", + "url": "https://www.cve.org/CVERecord?id=CVE-2024-6984" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-209" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T17:18:32Z", + "nvd_published_at": "2024-07-29T14:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-6vjm-54vp-mxhx/GHSA-6vjm-54vp-mxhx.json b/advisories/github-reviewed/2024/08/GHSA-6vjm-54vp-mxhx/GHSA-6vjm-54vp-mxhx.json new file mode 100644 index 00000000000..57efa255b1a --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-6vjm-54vp-mxhx/GHSA-6vjm-54vp-mxhx.json @@ -0,0 +1,147 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6vjm-54vp-mxhx", + "modified": "2024-08-05T17:19:11Z", + "published": "2024-08-05T17:19:11Z", + "aliases": [ + + ], + "summary": "Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm", + "details": "An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm. A potential exploit where a user can run a bash loop attempting to execute hook tools. If running while another hook is executing, we log an error with the context ID, making it possible for the user to then use that ID in a following call successfully. This means an unprivileged user can access anything available via a hook tool such as config, relation data and secrets.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.50" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.1.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2.0" + }, + { + "fixed": "3.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4.0" + }, + { + "fixed": "3.4.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.5.0" + }, + { + "fixed": "3.5.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6984" + }, + { + "type": "WEB", + "url": "https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/juju/juju" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-209", + "CWE-269", + "CWE-284" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T17:19:11Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json b/advisories/unreviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json deleted file mode 100644 index f993e9fc978..00000000000 --- a/advisories/unreviewed/2024/07/GHSA-8c64-q78q-87r6/GHSA-8c64-q78q-87r6.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-8c64-q78q-87r6", - "modified": "2024-07-29T15:30:39Z", - "published": "2024-07-29T15:30:38Z", - "aliases": [ - "CVE-2024-6984" - ], - "details": "An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6984" - }, - { - "type": "WEB", - "url": "https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2" - }, - { - "type": "WEB", - "url": "https://www.cve.org/CVERecord?id=CVE-2024-6984" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-209" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-07-29T14:15:04Z" - } -} \ No newline at end of file