CVE-2024-7558 — Predictable Seed in Pseudo-Random Number Generator in LTD Juju

CWE-337 — Predictable Seed in Pseudo-Random Number GeneratorCWE-340 — Generation of Predictable Numbers or IdentifiersCWE-1391 — Use of Weak CredentialsCWE-330 — Use of Insufficiently Random ValuesCWE-335 — Incorrect Usage of Seeds in Pseudo-Random Number Generator5 documents4 sources
Severity
8.0HIGHNVD
CNA8.7
EPSS
0.2%
top 58.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Canonical LTD JujuGithub.com Juju JujuCanonical Juju
Timeline
PublishedOct 2
Latest updateOct 9

Description

JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages3 packages

▶NVDcanonical/juju3.1.0 — 3.1.10+5
▶CVEListV5canonical_ltd/juju3.5 — 3.5.4+4
▶Gogithub.com/juju_juju< 0.0.0-20240826044107-ecd7e2d0e986

Patches

Patch: github.com ↗

🔴Vulnerability Details

4
OSV
JUJU_CONTEXT_ID is a predictable authentication secret in github.com/juju/juju↗2024-10-09
▶
GHSA
JUJU_CONTEXT_ID is a predictable authentication secret↗2024-10-03
▶
OSV
JUJU_CONTEXT_ID is a predictable authentication secret↗2024-10-03
▶
CVEList
CVE-2024-7558: JUJU_CONTEXT_ID is a predictable authentication secret↗2024-10-02
▶
CVE-2024-7558 — Canonical LTD Juju vulnerability | cvebase