CVE Vulnerabilities

CVE-2024-7558

Predictable Seed in Pseudo-Random Number Generator (PRNG)

Published: Oct 02, 2024 | Modified: Aug 26, 2025
CVSS 3.x
8
HIGH
Source:
NVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.

Weakness

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.

Affected Software

Name Vendor Start Version End Version
Juju Canonical * 2.9.51 (excluding)
Juju Canonical 3.1.0 (including) 3.1.10 (excluding)
Juju Canonical 3.2.0 (including) 3.2.4 (excluding)
Juju Canonical 3.3.0 (including) 3.3.7 (excluding)
Juju Canonical 3.4 (including) 3.4.6 (excluding)
Juju Canonical 3.5.0 (including) 3.5.4 (excluding)
Juju Ubuntu snap *
Juju Ubuntu upstream *

Potential Mitigations

References