x/vulndb: potential Go vuln in github.com/juju/juju: GHSA-fc27-7pf5-96v3

[GoVulnBot]

Advisory GHSA-fc27-7pf5-96v3 references a vulnerability in the following Go modules:

Module
github.com/juju/juju

Description:

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-8v4w-f4r9-7h6x. This link is maintained to preserve external references.

Original Description

Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.

References:

• ADVISORY: GHSA-fc27-7pf5-96v3
• WEB: GHSA-8v4w-f4r9-7h6x
• WEB: https://nvd.nist.gov/vuln/detail/CVE-2024-8037
• WEB: https://www.cve.org/CVERecord?id=CVE-2024-8037

Cross references:

• github.com/juju/juju appears in 3 other report(s):
  • data/excluded/GO-2023-1598.yaml (x/vulndb: potential Go vuln in github.com/juju/juju: GHSA-x5rv-w9pm-8qp8 #1598) NOT_IMPORTABLE
  • data/reports/GO-2024-3010.yaml (x/vulndb: potential Go vuln in github.com/juju/juju: CVE-2024-6984 #3010)
  • data/reports/GO-2024-3040.yaml (x/vulndb: potential Go vuln in github.com/juju/juju: GHSA-6vjm-54vp-mxhx #3040)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/juju/juju
      versions:
        - fixed: 0.0.0-20241001032836-2af7bd8e310b
summary: 'Duplicate Advisory: Vulnerable juju hook tool abstract UNIX domain socket in github.com/juju/juju'
ghsas:
    - GHSA-fc27-7pf5-96v3
references:
    - advisory: https://github.com/advisories/GHSA-fc27-7pf5-96v3
    - web: https://github.com/juju/juju/security/advisories/GHSA-8v4w-f4r9-7h6x
    - web: https://nvd.nist.gov/vuln/detail/CVE-2024-8037
    - web: https://www.cve.org/CVERecord?id=CVE-2024-8037
notes:
    - fix: 'github.com/juju/juju: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
source:
    id: GHSA-fc27-7pf5-96v3
    created: 2024-10-02T22:01:21.325964843Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/619155 mentions this issue: data/excluded: add 3 reports