What’s Vulnerable › Vulnerabilities
CVE-2025-6224: Key leakage in juju/utils certificates
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-07-01 · updated 2026-06-17
- Weakness: CWE-312
Description
Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.
Affected products
- Canonical Juju/Utils: from 4.0.0 before 4.0.4 — fixed in 4.0.4
How to fix
Upgrade to a fixed version: Canonical Juju/Utils 4.0.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-6224 or the next vulnerability affects your stack