304 matches found
CVE-2024-6984
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm...
Juju 安全漏洞
Juju is an open source application orchestration engine from Canonical Juju Open Source. A security vulnerability exists in Juju. An attacker exploiting the vulnerability could access sensitive data...
GHSA-HCMV-JMQH-FJGM ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
Summary The issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processing subprocess.CalledProcessError. There are two points that may log this command, in...
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
Summary The issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processing subprocess.CalledProcessError. There are two points that may log this command, in...
CVE-2024-41129
The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processi...
CVE-2024-41129 The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processi...
CVE-2024-41129
The CVE-2024-41129 issue affects the ops library (Python framework used with Juju charms) where secret content can be passed as a CLI argument, potentially exposing secrets via subprocess.CalledProcessError logging. Connected Red Hat, Veracode, OSV, and CVE records confirm the root cause and indi...
CVE-2024-41129 The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processi...
CVE-2024-41129 The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processi...
GHSA-4685-2X5R-65PJ Pebble service manager's file pull API allows access by any user
Impact Note: "Pebble" here refers to Canonical's service manager, not the Let's Encrypt ACME test server. The API behind pebble pull, used to read files from the workload container by Juju charms, allows access from any user, instead of just admin. In Juju Kubernetes sidecar charms, Pebble and th...
Pebble service manager's file pull API allows access by any user
Impact Note: "Pebble" here refers to Canonical's service manager, not the Let's Encrypt ACME test server. The API behind pebble pull, used to read files from the workload container by Juju charms, allows access from any user, instead of just admin. In Juju Kubernetes sidecar charms, Pebble and th...
Information Disclosure
github.com/juju/juju is vulnerable to Information Disclosure. A remote authenticated attacker with access to the control model is able to construct a remote request to download an arbitrary file from the controller's file system and gain access to sensitive information...
Juju controller - Arbitrary file reading vulnerability
Impact An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem. Patches Patched in juju 2.9.38 and juju 3.0.3 juju/jujuef803e2 Workarounds Limit read access to the controller model to onl...
PT-2023-16007 · Canonical · Juju
Name of the Vulnerable Software and Affected Versions: juju versions prior to 2.9.38 juju versions prior to 3.0.3 Description: An authenticated user who has read access to the juju controller model may construct a remote request to download an arbitrary file from the controller's filesystem...
Juju uses a UNIX domain socket without setting appropriate permissions
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root...
GHSA-J3HP-PV6V-RGRX Juju uses a UNIX domain socket without setting appropriate permissions
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root...
Juju Core Joyent provider encryption issue vulnerability
Juju Infrastructure specializes in software and solutions. An encryption issue vulnerability exists in Juju Core's Joyent provider prior to version 1.25.5. The vulnerability stems from a network system or product that does not properly use the relevant cryptographic algorithms and can be exploite...
Information Disclosure
github.com/juju/juju is vulnerable to information disclosure. The SSH private key is uploaded by the joyent provider, which could lead to the exposure of the private keys and grant SSH access to an attacker who is able to obtain the private key...