CVE-2025-6224

Key leakage in juju/utils certificates

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.

Affected

Canonical · Juju utils

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.16% chance of exploitation in the next 30 days, 4th percentile

Published

2025-07-01

Proof-of-concept exploits (1)

• juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr

Security advisories

• advisories/GHSA-h34r-jxqm-qgpr

References

• CVE Record
• NVD entry