CVE-2024-8038

Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.

CVSS v3 7.9 HIGH

7.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 5.3

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq	Patch Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2024-8038	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:canonical:juju::::::::
	cpe:2.3:a:canonical:juju::::::::
	cpe:2.3:a:canonical:juju::::::::
	cpe:2.3:a:canonical:juju::::::::
	cpe:2.3:a:canonical:juju::::::::
	cpe:2.3:a:canonical:juju::::::::

History

26 Aug 2025, 17:44

Type	Values Removed	Values Added
CPE		cpe:2.3:a:canonical:juju::::::::
References	~~() https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq -~~	() https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq - Patch, Vendor Advisory
References	~~() https://www.cve.org/CVERecord?id=CVE-2024-8038 -~~	() https://www.cve.org/CVERecord?id=CVE-2024-8038 - Third Party Advisory
CWE		NVD-CWE-noinfo
First Time		Canonical Canonical juju

Information

Published : 2024-10-02 11:15

Updated : 2025-08-26 17:44

NVD link : CVE-2024-8038

Mitre link : CVE-2024-8038

CVE.ORG link : CVE-2024-8038

JSON object : View

Products Affected

canonical

juju

CWE

CWE-420

Unprotected Alternate Channel

NVD-CWE-noinfo

{"id": "CVE-2024-8038", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 2.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-10-02T11:15:11.853", "references": [{"url": "https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq", "tags": ["Patch", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2024-8038", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-420"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks."}, {"lang": "es", "value": "Socket de dominio UNIX abstracto de introspecci\u00f3n de juju vulnerable. Un socket de dominio UNIX abstracto responsable de la introspecci\u00f3n est\u00e1 disponible sin autenticaci\u00f3n localmente para los usuarios del espacio de nombres de la red. Esto permite ataques de denegaci\u00f3n de servicio."}], "lastModified": "2025-08-26T17:44:59.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "956F1957-34C5-47D9-B922-107963295A1F", "versionEndExcluding": "2.9.51"}, {"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "32122910-827A-438E-B1DD-42C8E24D7F5D", "versionEndExcluding": "3.1.10", "versionStartIncluding": "3.1.0"}, {"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA2EB481-D7FF-4A83-B7ED-A6FCE9AE1029", "versionEndIncluding": "3.2.4", "versionStartIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3C17769-1003-49A2-A87C-003A9E7E81CD", "versionEndExcluding": "3.3.7", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6693CCDC-308E-40B3-BC8A-F9A2320A06F9", "versionEndExcluding": "3.4.6", "versionStartIncluding": "3.4"}, {"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62BC59FA-04DB-4AC3-977D-691ED721171F", "versionEndExcluding": "3.5.4", "versionStartIncluding": "3.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}