CVE-2017-9232Juju Missing Authorization
Juju uses a UNIX domain socket without setting appropriate permissions
Published May 13, 2022 · Updated Aug 7, 2026 · Also known as GHSA-j3hp-pv6v-rgrx, GO-2025-3639, UBUNTU-CVE-2017-9232, USN-3300-1
Key Facts
Patch immediately- CVE-2017-9232 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Juju (Canonical), juju-core-1 (ubuntu), juju-core (ubuntu) and 2 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 49% probability of exploitation in the next 30 days.
- Fixed versions are available, including Juju 1.25.12, github.com/juju/juju 0.0.0-20170524231039-0417178a3c28, govulncheck-vulndb 0.0.20250424T181457-1.1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
49%
Higher than 98.8% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
61/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.
Affected Products
43 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| JujuCanonical | 2.0.0, 2.0.0-alpha1, 2.0.0-alpha2, 2.0.0-beta1, 2.0.0-beta10, 2.0.0-beta11, 2.0.0-beta12, 2.0.0-beta13 | 1.25.12 |
| juju-core-1ubuntu | See advisory | 1.25.6-0ubuntu1.16.04.2 |
| juju-coreubuntu | See advisory | 1.25.6-0ubuntu1.14.04.2 |
| github.com/juju/jujugo | See advisory | 0.0.0-20170524231039-0417178a3c28 |
| govulncheck-vulndbsuse | See advisory | 0.0.20250424T181457-1.1 |
Patched Releases
Juju
1.25.12
github.com/juju/juju
0.0.0-20170524231039-0417178a3c28
govulncheck-vulndb
0.0.20250424T181457-1.1
juju-core
1.25.6-0ubuntu1.14.04.2, 2.0.2-0ubuntu0.16.04.2
juju-core-1
1.25.6-0ubuntu1.16.04.2
Timeline
Publicly disclosed
May 13, 2022
Last updated
Aug 7, 2026
Weakness Type
- CWE-862 Missing Authorization
References
- advisorynvd.nist.gov · CVE-2017-9232
- advisoryubuntu.com · CVE-2017-9232
- advisorycve.org · CVERecord
- advisoryGHSA advisory
- advisoryubuntu.com · USN-3300-1
FAQ
Common Questions.
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.
Affected: Juju (Canonical) versions 2.0.0, 2.0.0-alpha1, 2.0.0-alpha2, 2.0.0-beta1, 2.0.0-beta10, 2.0.0-beta11, 2.0.0-beta12, 2.0.0-beta13; juju-core-1 (ubuntu); juju-core (ubuntu), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Juju 1.25.12, github.com/juju/juju 0.0.0-20170524231039-0417178a3c28, govulncheck-vulndb 0.0.20250424T181457-1.1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2017-9232 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo