Josh Mcsavaney

Name of the Vulnerable Software and Affected Versions: juju/utils (affected versions not specified) Description: The issue concerns the generation of certificates in juju/utils using the cert.NewLeaf function, which could potentially include private information. If such a certificate is transferred over the network in plaintext, an attacker could intercept it and easily extract the private key. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** glog (affected versions not specified) **Description** The issue arises when logs are written to a widely-writable directory, allowing an unprivileged attacker to predict a privileged process's log file path and create a symbolic link to a sensitive file in its place. When the privileged process runs, it follows the planted symlink and overwrites the sensitive file. To address this, glog now exits the program with a status code of 2 when it discovers that the configured log file already exists. **Recommendations** To resolve the issue, ensure that glog is configured to write logs to a directory that is not widely writable. As a temporary workaround, consider restricting write access to the log directory to prevent unprivileged attackers from creating symbolic links to sensitive files. Avoid using widely-writable directories for logging until the issue is fully addressed.