Aller au contenu
en Se connecter
8.8 Élevée

CVE-2025-0928 In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent…

Description

In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution.

Produits et versions touchés

Produit Versions touchées Corrigé en
Juju 3.0 3.0.0 → < 3.6.8 3.6.8
Juju 2.0 2.0.0 → < 2.9.52 2.9.52

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Juju

Les 13 CVE de Juju →
CVE-2026-93336 Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a… 7.1 Élevée CVE-2026-5412 In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade 9.9 Critique CVE-2026-5774 Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow… 6.1 Moyenne CVE-2026-4370 A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the… 10.0 Critique
Suivre cette CVE