CVE-2017-9232 Juju uses a UNIX domain socket without setting appropriate permissions
Local users can escalate privileges to root due to insecure permissions on Juju's UNIX domain socket.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-9232?
CVE-2017-9232 is a critical vulnerability in n/a, published on 28 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.
Weakness: CWE-862
Which versions are affected by CVE-2017-9232?
3 open source packages ship an affected version, including github.com/juju/juju. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/juju/juju Go | All versions | 0.0.0-20170524231039-0417178a3c28 |
github.com/juju/juju Go | All versions | 0.0.0-20170524231039-0417178a3c28 |
github.com/juju/juju Go | All versions | 0.0.0-20170524231039-0417178a3c28 |
Products include Canonical Juju.
How do I fix CVE-2017-9232?
Upgrade github.com/juju/juju to 0.0.0-20170524231039-0417178a3c28 or later.
Is CVE-2017-9232 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-9232 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in n/a
- CVE-2026-4370 Improper TLS Client/Server authentication and certificate verification on Database Cluster
- CVE-2026-5412 Juju CloudSpec API could leak senstive information
- CVE-2026-32693 Unauthorized access to Kubernetes secrets in Juju
- CVE-2025-0928 Arbitrary executable upload via authenticated endpoint
- CVE-2025-53513 Zip slip vulnerability in Juju
Sources
Also known as GHSA-j3hp-pv6v-rgrx, GO-2025-3639, UBUNTU-CVE-2017-9232, USN-3300-1.