CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NCVE-2025-6224
Medium (6.5) in canonical juju\/utils. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/juju/utils/v4/cert 4.0.4.
Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
- CWE
- CWE-312
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:juju\/utils
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h34r-jxqm-qgpr | Go | github.com/juju/utils/v4/cert | <4.0.4 | 4.0.4 |
| GO-2025-3798 | Go | github.com/juju/utils | all versions | no fix published |
| GO-2025-3798 | Go | github.com/juju/utils/v2 | all versions | no fix published |
| GO-2025-3798 | Go | github.com/juju/utils/v3 | all versions | no fix published |
| GO-2025-3798 | Go | github.com/juju/utils/v4 | <4.0.4 | 4.0.4 |