CVE-2025-6224
Key leakage in juju/utils certificates
- State
- Published
- Severity
- 6.5 Medium
- Published
- Jul 1, 2025
- Updated
- Jul 1, 2025
- Reserved
- Jun 18, 2025
Description
Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | canonical |
Weaknesses
- CWE-312 Cleartext Storage of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
Juju utilsCanonical |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.