Skip to content
OpenAdvisories
Critical USN-3300-1 1 CVE

juju-core vulnerability

Published May 26, 2017 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Ryan Beisner discovered juju did not set permissions on a Unix domain
socket. A local attacker could use this flaw to gain administrative
privileges.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS juju-core 1.25.6-0ubuntu1.14.04.2
Ubuntu · 16.04 LTS 16.04:LTS juju-core 2.0.2-0ubuntu0.16.04.2

Vulnerabilities 1

  • Critical 9.8
    CVE-2017-9232 Public exploit EPSS 49%

    Juju uses a UNIX domain socket without setting appropriate permissions

    Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

    github.com/juju/juju juju-core juju-core-1 Ubuntu Go

References

  • report
    https://ubuntu.com/security/CVE-2017-9232