GHSA-x5rv-w9pm-8qp8MediumCVSS 4.9

Juju controller - Arbitrary file reading vulnerability

Published
March 1, 2023
Last Modified
February 7, 2025

🔗 CVE IDs covered (1)

CVE-2023-0092 →

📋 Description

Impact

An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.

Patches

Patched in juju 2.9.38 and juju 3.0.3 juju/juju#ef803e2

Workarounds

Limit read access to the controller model to only trusted users.

🎯 Affected products2

  • go/github.com/juju/juju:>= 2.9.22, < 2.9.38
  • go/github.com/juju/juju:>= 3.0.0, < 3.0.3

🔗 References (5)