Vulnerability · Published Jul 1, 2025 · Assigned by canonical
CVE-2025-6224Key leakage in juju/utils certificates
Medium 6.5
In plain English
A medium-severity security flaw in Juju utils from Canonical. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 95.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/juju/utils | no fix listed | GO-2025-3798 |
| Go | github.com/juju/utils/v2 | no fix listed | GO-2025-3798 |
| Go | github.com/juju/utils/v3 | no fix listed | GO-2025-3798 |
| Go | github.com/juju/utils/v4 | 4.0.4 | GO-2025-3798 |
| Go | github.com/juju/utils/v4/cert | 4.0.4 | GHSA-h34r-jxqm-qgpr |
| Ubuntu:22.04:LTS | golang-github-juju-utils | no fix listed | UBUNTU-CVE-2025-6224 |
| Ubuntu:24.04:LTS | golang-github-juju-utils | no fix listed | UBUNTU-CVE-2025-6224 |
| Ubuntu:25.10 | golang-github-juju-utils | no fix listed | UBUNTU-CVE-2025-6224 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Juju utils | 4.0.1 – through 4.0.3 |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N