CVE-2024-7558: canonical ltd. juju

Vulnerability summary

CVE-2024-7558 is a high (CVSS 8.7) vulnerability in canonical ltd. juju. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 02-10-2024
   PublishedVulnerability first disclosed.
2. 02-10-2024
   Last modifiedVulnerability information updated.

Description

JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.

• CWE-337Predictable Seed in Pseudo-Random Number Generator (PRNG)A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
• CWE-340Generation of Predictable Numbers or IdentifiersThe product uses a scheme that generates numbers or identifiers that are more predictable than required.
• CWE-1391Use of Weak CredentialsThe product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
• CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
• CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.