VDB

CVE-2025-6224

CVE-2025-6224 PUBLISHED CVSS 6.5 MEDIUM

Key leakage in juju/utils certificates

Reported by canonical · Published July 1, 2025

github.com/juju/utils/v4 is fixed in 4.0.4 (Go Modules)

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
github.com/juju/utils/v4Go Modules4.0.4
github.com/juju/utils/v4/certGo Modules4.0.4
juju\/utilscanonical4.0.4
juju utilsCanonical4.0.3

Risk scores

CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

VendorProductVersions
CanonicalJuju utils4.0.1
CanonicalJuju utils4.0.1
github.comjuju/utils/v4/cert0

Timeline

  • Jul 1, 2025 CVE Published
  • Jul 1, 2025 EPSS Score (30 in total, the first dated here)
  • Jul 1, 2025 Coalition ESS Score (11 in total, the first dated here)
  • Jul 1, 2025 CVE Updated
  • Mar 17, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-6224
vulnetix vdb fixes CVE-2025-6224

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-6224/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›