CVE-2024-8038

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-02 · updated 2026-06-17
Weakness: CWE-420

Description

Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.

Affected products

Canonical Juju: before 2.9.51; from 3.1.0 before 3.1.10; from 3.2.0 through 3.2.4; from 3.3 before 3.3.7; from 3.4 before 3.4.6; from 3.5.0 before 3.5.4 — fixed in 2.9.51, 3.1.10, 3.3.7, 3.4.6, 3.5.4

How to fix

Upgrade to a fixed version: Canonical Juju 2.9.51, 3.1.10, 3.3.7, 3.4.6. Check the vendor advisory for mitigations.

References

https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq
https://www.cve.org/CVERecord?id=CVE-2024-8038

Get alerted when CVE-2024-8038 or the next vulnerability affects your stack