CVE-2024-7558CWE-1391CWE-337CWE-340

JUJU_CONTEXT_ID is a predictable authentication secret

High · published October 2, 2024

CVSS v3.1
8.7
EPSS
1%
Percentile
42.1
In the wild
Unconfirmed
What it is

JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00502 · 42.1th percentile
Weaknesses
CWE-1391 · Use of Weak Credentials; CWE-337 · Predictable Seed in Pseudo-Random Number Generator (PRNG); CWE-340 · Generation of Predictable Numbers or Identifiers
Published
2024-10-02T10:06Z
EPSS history
Timeline
  • 02 OCT 10:06Z
    JUJU_CONTEXT_ID is a predictable authentication secret
    cvelistv5