Moderate severityNVD Advisory· Published Jul 1, 2025· Updated Jul 1, 2025

Key leakage in juju/utils certificates

CVE-2025-6224

Description

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/juju/utils/v4/certGo	< 4.0.4	4.0.4

Affected products

ghsa-coords2 versions
pkg:golang/github.com/juju/utils/v4/cert pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
< 4.0.4+ 1 more
- (no CPE)range: < 4.0.4
- (no CPE)range: < 0.0.20250730T213748-1.1
Canonical/Juju utilsv5
Range: 4.0.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-h34r-jxqm-qgprghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-6224ghsaADVISORY
github.com/juju/utils/commit/766f27d7bcd10433453a9764509a864c17a46a76ghsaWEB
github.com/juju/utils/releases/tag/v4.0.4ghsaWEB
github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgprghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000