Medium severity · published Jul 1, 2025
CVE-2025-6224
Key leakage in juju/utils certificates
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JU
Juju utils · Canonical
4.0.1 through 4.0.3 · source: vendor
JU
Juju/utils · Canonical
4.0.0 before 4.0.4 · source: NVD