Publish Advisories

GHSA-8v4w-f4r9-7h6x GHSA-r7pg-v2c8-mfg3 GHSA-x5q3-c8rm-w787 GHSA-xwgj-vpm9-q2rq GHSA-r7pg-v2c8-mfg3
2026-05-22 18:04:22 -07:00 · 2024-10-03 16:54:17 +00:00
parent 91262050e2
commit ef85b18125
5 changed files with 288 additions and 35 deletions
@@ -0,0 +1,77 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8v4w-f4r9-7h6x",
+  "modified": "2024-10-03T16:53:20Z",
+  "published": "2024-10-03T16:53:20Z",
+  "aliases": [
+    "CVE-2024-8037"
+  ],
+  "summary": "Vulnerable juju hook tool abstract UNIX domain socket",
+  "details": "### Impact\nWhen combined with an attack of `JUJU_CONTEXT_ID`, any user on the local system with access to the default network namespace may connect to the `@/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket` and perform actions that are normally reserved to a juju charm.\n\n### Patches\nPatch: https://github.com/juju/juju/commit/2f2ec128ef5a8ca81fc86ae79cfcdbab0007c206\nPatched in:\n- 3.5.4\n- 3.4.6\n- 3.3.7\n- 3.1.10\n- 2.9.51\n\n### Workarounds\nNo workarounds available.\n\n### References\n[GHSA-mh98-763h-m9v4](https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4)\nhttps://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/uniter/paths.go#L222",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/juju/juju"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.0.0-20240820065804-2f2ec128ef5a"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/juju/juju/security/advisories/GHSA-8v4w-f4r9-7h6x"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8037"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/juju/juju/commit/2f2ec128ef5a8ca81fc86ae79cfcdbab0007c206"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/juju/juju"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/uniter/paths.go#L222"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-03T16:53:20Z",
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-r7pg-v2c8-mfg3",
+  "modified": "2024-10-03T16:52:52Z",
+  "published": "2024-10-03T12:30:48Z",
+  "aliases": [
+    "CVE-2024-47561"
+  ],
+  "summary": "Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)",
+  "details": "Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.\nUsers are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.avro:avro-parent"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.11.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/avro"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-03T16:52:52Z",
+    "nvd_published_at": "2024-10-03T11:15:13Z"
+  }
+}
@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xwgj-vpm9-q2rq",
+  "modified": "2024-10-03T16:53:26Z",
+  "published": "2024-10-03T16:53:26Z",
+  "aliases": [
+    "CVE-2024-8038"
+  ],
+  "summary": "Vulnerable juju introspection abstract UNIX domain socket",
+  "details": "### Impact\nAn abstract UNIX domain socket responsible for introspection is available without authentication locally to any user with access to the network namespace where the local juju agent is running.\n\nOn a juju controller agent, denial of service can be performed by using the `/leases/revoke` endpoint. Revoking leases in juju can cause availability issues.\n\nOn a juju machine agent that is hosting units, disabling the unit component can be performed using the `/units` endpoint with a \"stop\" action.\n\n### Patches\nPatch: https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b\nPatched in:\n- 3.5.4\n- 3.4.6\n- 3.3.7\n- 3.1.10\n- 2.9.51\n\n### Workarounds\nNo workaround.\n\n### References\nhttps://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/introspection/worker.go#L125\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/juju/juju"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.0.0-20240829052008-43f0fc59790d"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8038"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/juju/juju"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/introspection/worker.go#L125"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-03T16:53:26Z",
+    "nvd_published_at": null
+  }
+}
@@ -1,35 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-r7pg-v2c8-mfg3",
-  "modified": "2024-10-03T12:30:48Z",
-  "published": "2024-10-03T12:30:48Z",
-  "aliases": [
-    "CVE-2024-47561"
-  ],
-  "details": "Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.\nUsers are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-502"
-    ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-10-03T11:15:13Z"
-  }
-}