GitHub Advisoryadvisory · Go

GHSA-j3hp-pv6v-rgrx Juju uses a UNIX domain socket without setting appropriate permissions

CRITICAL Published 2022-05-13 Modified 2025-04-22 Official page ↗
Aliases
CVE-2017-9232
Ecosystem
Go
Packages
github.com/juju/juju
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-862
Reviewed
2025-04-22

Affected packages

• Go github.com/juju/juju: < 0.0.0-20170524231039-0417178a3c28 → fixed in 0.0.0-20170524231039-0417178a3c28

Description

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Related

Alias · CVE (1)

  • CVE-2017-9232 Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References