Incorrect Default Permissions

Summary

Juju is an open source application orchestration engine that enables any application operation. Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of "JUJU_CONTEXT_ID", any user on the local system with access to the default network namespace may connect to the "@/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket", and perform actions that are normally reserved to a juju charm. This vulnerability affects github.com/juju/juju package versions through 2.9.50, 3.0-beta1 through 3.1.9, 3.2-beta1 through 3.3.6, 3.4-beta1 through 3.4.5, 3.5-beta1 through 3.5.3, and 3.6-beta1 through 4.0-beta4.