Description
An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | Juju | 2.9.22 – < 2.9.38, 3.0.0 – < 3.0.3, 2.9.38 – < 3.0.3 | 2.9.38 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/juju/juju | >= 2.9.22, < 2.9.38 | 2.9.38 | GHSA-x5rv-w9pm-8qp8 |
| Go | github.com/juju/juju | >= 3.0.0, < 3.0.3 | 3.0.3 | GHSA-x5rv-w9pm-8qp8 |