CVE-2017-9232

Juju uses a UNIX domain socket without setting appropriate permissions

9.8 CriticalPublic exploitFix available

CVE-2017-9232 is a critical vulnerability (CVSS 9.8) in Canonical Juju, published May 26, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 48.5%, the 98th percentile. Fixed in github.com/juju/juju 0.0.0-20170524231039-0417178a3c28.

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

48.5%Down 18.3 points since Mar 1, 2023

What each source reports

NVD Score used 9.8

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Record: CVE-2017-9232
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-862
Updated: 2026-11-02

CVE List No score

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Record: CVE-2017-9232
Updated: 2026-11-02

EUVDEUVD-2017-18170 No score

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Record: EUVD-2017-18170
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j3hp-pv6v-rgrx 9.8

Juju uses a UNIX domain socket without setting appropriate permissions

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Record: GHSA-j3hp-pv6v-rgrx
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-862
Updated: 2026-11-02

OSV 9.8

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Record: CVE-2017-9232
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-j3hp-pv6v-rgrx 9.8

Juju uses a UNIX domain socket without setting appropriate permissions

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Record: GHSA-j3hp-pv6v-rgrx
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-862
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2017-9232 9.8

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Record: UBUNTU-CVE-2017-9232
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGO-2025-3639 No score

Juju uses a UNIX domain socket without setting appropriate permissions in github.com/juju/juju

Juju uses a UNIX domain socket without setting appropriate permissions in github.com/juju/juju

Record: GO-2025-3639
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15033-1 No score

govulncheck-vulndb-0.0.20250424T181457-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250424T181457-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15033-1
Updated: 2026-11-02

OSVUSN-3300-1 No score

juju-core vulnerability

Ryan Beisner discovered juju did not set permissions on a Unix domain socket. A local attacker could use this flaw to gain administrative privileges.

Record: USN-3300-1
Updated: 2026-11-02

Affected products

canonical juju

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/juju/juju` Go	before 0.0.0-20170524231039-0417178a3c28	0.0.0-20170524231039-0417178a3c28
`juju-core` Ubuntu:14.04:LTS	before 1.25.6-0ubuntu1.14.04.2, plus listed versions 1.16.0-0ubuntu11.16.2-0ubuntu11.16.3-0ubuntu11.16.4-0ubuntu11.16.5-0ubuntu1 Show 20 moreShow less 1.17.0-0ubuntu21.17.0-0ubuntu31.17.1-0ubuntu21.17.2-0ubuntu21.17.2-0ubuntu31.17.2-0ubuntu41.17.3-0ubuntu11.17.4-0ubuntu11.17.4-0ubuntu21.17.6-0ubuntu11.17.7-0ubuntu11.18.0-0ubuntu11.18.1-0ubuntu11.18.4+dfsg-0ubuntu0.14.04.11.20.11-0ubuntu0.14.04.11.22.6-0ubuntu1~14.04.11.22.8-0ubuntu1~14.04.11.24.7-0ubuntu1~14.04.11.25.5-0ubuntu3~14.04.11.25.6-0ubuntu1.14.04.1	1.25.6-0ubuntu1.14.04.2
`juju-core` Ubuntu:16.04:LTS	before 2.0.2-0ubuntu0.16.04.2, plus listed versions 1.24.6-0ubuntu31.25.0-0ubuntu11.25.0-0ubuntu21.25.0-0ubuntu32.0~beta4-0ubuntu2 Show 6 moreShow less 2.0~beta6-0ubuntu1.16.04.12.0~beta7-0ubuntu1.16.04.12.0~beta12-0ubuntu1.16.04.12.0~beta15-0ubuntu2.16.04.12.0.0-0ubuntu0.16.04.22.0.2-0ubuntu0.16.04.1	2.0.2-0ubuntu0.16.04.2
`juju-core-1` Ubuntu:16.04:LTS	before 1.25.6-0ubuntu1.16.04.2, plus listed versions 1.25.4-0ubuntu51.25.5-0ubuntu11.25.5-0ubuntu31.25.6-0ubuntu1.16.04.1	1.25.6-0ubuntu1.16.04.2
`govulncheck-vulndb` openSUSE:Tumbleweed	before 0.0.20250424T181457-1.1	0.0.20250424T181457-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Juju-run Agent - Privilege Escalation (Metasploit)	2018-02-12
Metasploit	Juju-run Agent Privilege Escalation	2017-04-13

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

References

Show 10 moreShow less