x/vulndb: potential Go vuln in github.com/juju/juju: GHSA-phh4-3hmm-24rx

[GoVulnBot]

Advisory GHSA-phh4-3hmm-24rx references a vulnerability in the following Go modules:

Module
github.com/juju/juju

Description:

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mh98-763h-m9v4. This link is maintained to preserve external references.

Original Description

JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.

References:

• ADVISORY: GHSA-phh4-3hmm-24rx
• WEB: GHSA-mh98-763h-m9v4
• WEB: https://nvd.nist.gov/vuln/detail/CVE-2024-7558
• WEB: https://www.cve.org/CVERecord?id=CVE-2024-7558

Cross references:

• github.com/juju/juju appears in 3 other report(s):
  • data/excluded/GO-2023-1598.yaml (x/vulndb: potential Go vuln in github.com/juju/juju: GHSA-x5rv-w9pm-8qp8 #1598) NOT_IMPORTABLE
  • data/reports/GO-2024-3010.yaml (x/vulndb: potential Go vuln in github.com/juju/juju: CVE-2024-6984 #3010)
  • data/reports/GO-2024-3040.yaml (x/vulndb: potential Go vuln in github.com/juju/juju: GHSA-6vjm-54vp-mxhx #3040)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/juju/juju
      versions:
        - fixed: 0.0.0-20241001032836-2af7bd8e310b
summary: 'Duplicate Advisory: Juju makes Use of Weak Credentials in github.com/juju/juju'
ghsas:
    - GHSA-phh4-3hmm-24rx
references:
    - advisory: https://github.com/advisories/GHSA-phh4-3hmm-24rx
    - web: https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4
    - web: https://nvd.nist.gov/vuln/detail/CVE-2024-7558
    - web: https://www.cve.org/CVERecord?id=CVE-2024-7558
notes:
    - fix: 'github.com/juju/juju: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
source:
    id: GHSA-phh4-3hmm-24rx
    created: 2024-10-02T22:01:22.289881393Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/619155 mentions this issue: data/excluded: add 3 reports