CVE-2024-7558

Katalog CVE

CVSS 8.0 · High EPSS 0,50%

Kerentanan Predictable Seed in Pseudo-Random Number Generator (PRNG) pada canonical juju. Skor CVSS 3.1 8.0 (High) menurut NVD.

Deskripsi (NVD)

JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.

Rincian

Terbit di NVD

2 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.0 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)
CWE-340: Generation of Predictable Numbers or Identifiers
CWE-1391: Use of Weak Credentials
CWE-330: Use of Insufficiently Random Values
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4 exploit · patch · advisory vendor
• https://www.cve.org/CVERecord?id=CVE-2024-7558 advisory pihak ketiga