Vulnerability-Lookup

CVE-2025-6224 (GCVE-0-2025-6224)

Vulnerability from cvelistv5 – Published: 2025-07-01 10:39 – Updated: 2025-07-01 14:30

Title

Key leakage in juju/utils certificates

Summary

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-01 14:30 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://github.com/juju/utils/security/advisories…

Impacted products

1 product

Vendor	Product	Version	CPE status
Canonical	Juju utils	Affected: 4.0.1 , ≤ 4.0.3 (semver)	guessed

Date Public

2025-07-01 00:00

Credits

Josh McSavaney

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6224",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T14:30:33.241503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T14:30:51.639Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "juju utils",
          "platforms": [
            "Linux"
          ],
          "product": "Juju utils",
          "repo": "https://github.com/juju/utils",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThanOrEqual": "4.0.3",
              "status": "affected",
              "version": "4.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Josh McSavaney"
        }
      ],
      "datePublic": "2025-07-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-131",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-131 Resource Leak Exposure"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T10:39:34.322Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "url": "https://github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr"
        }
      ],
      "source": {
        "advisory": "https://github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr",
        "discovery": "EXTERNAL"
      },
      "title": "Key leakage in juju/utils certificates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2025-6224",
    "datePublished": "2025-07-01T10:39:34.322Z",
    "dateReserved": "2025-06-18T08:48:41.677Z",
    "dateUpdated": "2025-07-01T14:30:51.639Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-6224",
      "date": "2026-09-14",
      "epss": "0.00135",
      "percentile": "0.03289"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-6224\",\"sourceIdentifier\":\"security@ubuntu.com\",\"published\":\"2025-07-01T11:15:21.770\",\"lastModified\":\"2026-06-17T10:01:24.803\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.\"},{\"lang\":\"es\",\"value\":\"La generaci\u00f3n de certificados en juju/utils mediante la funci\u00f3n cert.NewLeaf podr\u00eda incluir informaci\u00f3n privada. Si este certificado se transfiriera por la red en texto plano, un atacante que escuchara en esa red podr\u00eda rastrearlo y extraer f\u00e1cilmente su clave privada.\"}],\"affected\":[{\"source\":\"security@ubuntu.com\",\"affectedData\":[{\"vendor\":\"Canonical\",\"product\":\"Juju utils\",\"defaultStatus\":\"unaffected\",\"packageName\":\"juju utils\",\"platforms\":[\"Linux\"],\"repo\":\"https://github.com/juju/utils\",\"versions\":[{\"version\":\"4.0.1\",\"lessThanOrEqual\":\"4.0.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@ubuntu.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-07-01T14:30:33.241503Z\",\"id\":\"CVE-2025-6224\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@ubuntu.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-312\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:canonical:juju\\\\/utils:*:*:*:*:*:go:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.0.4\",\"matchCriteriaId\":\"A9C6BB14-8867-4606-9CCB-7EEBC1230202\"}]}]}],\"references\":[{\"url\":\"https://github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr\",\"source\":\"security@ubuntu.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-07-03T11:24:22+00:00",
      "cve": "CVE-2025-6224",
      "id": "CVE-2025-6224",
      "initial_release_date": "2025-07-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Key leakage in juju/utils certificates",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6224.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-25T02:06:15Z",
      "cve": "CVE-2025-6224",
      "id": "CVE-2025-6224",
      "initial_release_date": "2025-08-04T23:25:31Z",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-6224",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-6224.json",
      "version": "6"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-6224\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-01T14:30:33.241503Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-01T14:30:42.574Z\"}}], \"cna\": {\"title\": \"Key leakage in juju/utils certificates\", \"source\": {\"advisory\": \"https://github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Josh McSavaney\"}], \"impacts\": [{\"capecId\": \"CAPEC-131\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-131 Resource Leak Exposure\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/juju/utils\", \"vendor\": \"Canonical\", \"product\": \"Juju utils\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.0.3\"}], \"platforms\": [\"Linux\"], \"packageName\": \"juju utils\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-07-01T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-312\", \"description\": \"CWE-312 Cleartext Storage of Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"shortName\": \"canonical\", \"dateUpdated\": \"2025-07-01T10:39:34.322Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-6224\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-01T14:30:51.639Z\", \"dateReserved\": \"2025-06-18T08:48:41.677Z\", \"assignerOrgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"datePublished\": \"2025-07-01T10:39:34.322Z\", \"assignerShortName\": \"canonical\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-6224

Vulnerability from fkie_nvd - Published: 2025-07-01 11:15 - Updated: 2026-06-17 10:01

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security@ubuntu.com	https://github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	canonical	juju\/utils	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageName": "juju utils",
          "platforms": [
            "Linux"
          ],
          "product": "Juju utils",
          "repo": "https://github.com/juju/utils",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThanOrEqual": "4.0.3",
              "status": "affected",
              "version": "4.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@ubuntu.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:canonical:juju\\/utils:*:*:*:*:*:go:*:*",
              "matchCriteriaId": "A9C6BB14-8867-4606-9CCB-7EEBC1230202",
              "versionEndExcluding": "4.0.4",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it."
    },
    {
      "lang": "es",
      "value": "La generaci\u00f3n de certificados en juju/utils mediante la funci\u00f3n cert.NewLeaf podr\u00eda incluir informaci\u00f3n privada. Si este certificado se transfiriera por la red en texto plano, un atacante que escuchara en esa red podr\u00eda rastrearlo y extraer f\u00e1cilmente su clave privada."
    }
  ],
  "id": "CVE-2025-6224",
  "lastModified": "2026-06-17T10:01:24.803",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security@ubuntu.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-6224",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-07-01T14:30:33.241503Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-07-01T11:15:21.770",
  "references": [
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ],
      "source": "security@ubuntu.com",
      "type": "Secondary"
    }
  ]
}

GHSA-H34R-JXQM-QGPR

Vulnerability from github – Published: 2025-07-01 17:35 – Updated: 2025-07-01 17:35

Summary

juju/utils leaks private key in certs

Details

Summary

Certs generated by v4 contain their private key.

Details

Background

Recently, I encountered an API in Go that’s easy to misuse: sha512.Sum384 and sha512.New384().Sum look very similar and behave very differently. https://go.dev/play/p/kDCqqoYk84k demonstrates this. I want to discuss extending static analysis to detect this case with the go community, but before I do that, I want to make a best-effort pass at open-source projects to fix the existing bugs. I figured that if there were any vulnerabilities out there, they would be easy to find once that discussion begins, so it’s better to address them early.

This work is a hobby project and has no affiliation with my employer, so I may be slow to respond due to existing commitments.

PoC

https://go.dev/play/p/vSW0U3Hq4qk

Impact

This code (cert.NewLeaf) generates certs with the SubjectKeyId set to sha512.New384().Sum(/* private */ key).

If a cert which was generated by cert.NewLeaf is transferred over the network in plaintext, as is often the case in TLS handshakes, an attacker listening on that network may sniff the cert and trivially extract the private key from it. This applies to client and server TLS certs generated by vulnerable versions of this library.

Getting the server cert and its key would only require performing a TLS handshake (with a matching SNI) with the server. At that point, the attacker could impersonate the server.

Similarly, getting the client cert and its key would require getting the client to perform a TLS handshake against an attacker-controlled server. At that point, an attacker could impersonate the client.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.0.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/juju/utils/v4/cert"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-6224"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-01T17:35:16Z",
    "nvd_published_at": "2025-07-01T11:15:21Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nCerts generated by v4 contain their private key.\n\n## Details\n\n### Background\n\nRecently, I encountered an API in Go that\u2019s easy to misuse: sha512.Sum384 and sha512.New384().Sum look very similar and behave very differently. https://go.dev/play/p/kDCqqoYk84k demonstrates this. I want to discuss extending static analysis to detect this case with the go community, but before I do that, I want to make a best-effort pass at open-source projects to fix the existing bugs. I figured that if there were any vulnerabilities out there, they would be easy to find once that discussion begins, so it\u2019s better to address them early. \n\nThis work is a hobby project and has no affiliation with my employer, so I may be slow to respond due to existing commitments. \n\n### PoC\n\nhttps://go.dev/play/p/vSW0U3Hq4qk\n\n### Impact\n\n[This code](https://github.com/juju/utils/blob/0141ef0ee74a0cac603c5c9e4aff194008722f41/cert/cert.go#L120) (cert.NewLeaf) generates certs with the SubjectKeyId set to `sha512.New384().Sum(/* private */ key)`.\n\nIf a cert which was generated by cert.NewLeaf is transferred over the network in plaintext, as is often the case in TLS handshakes, an attacker listening on that network may sniff the cert and trivially extract the private key from it. This applies to client and server TLS certs generated by vulnerable versions of this library.\n\nGetting the server cert and its key would only require performing a TLS handshake (with a matching SNI) with the server. At that point, the attacker could impersonate the server.\n\nSimilarly, getting the client cert and its key would require getting the client to perform a TLS handshake against an attacker-controlled server. At that point, an attacker could impersonate the client.",
  "id": "GHSA-h34r-jxqm-qgpr",
  "modified": "2025-07-01T17:35:16Z",
  "published": "2025-07-01T17:35:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6224"
    },
    {
      "type": "WEB",
      "url": "https://github.com/juju/utils/commit/766f27d7bcd10433453a9764509a864c17a46a76"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/juju/utils"
    },
    {
      "type": "WEB",
      "url": "https://github.com/juju/utils/releases/tag/v4.0.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "juju/utils leaks private key in certs"
}

OPENSUSE-SU-2025:15405-1

Vulnerability from csaf_opensuse - Published: 2025-08-04 00:00 - Updated: 2025-08-04 00:00

Summary

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media

Severity

Moderate

Scope

56 vulnerabilities in this advisory, including CVE-2025-6224.

CVE-2025-6224

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Recommended: 4 products

Open the full advisory

ubuntu-cve-2025-6224

Vulnerability from osv_ubuntu

Published

2025-07-01 11:15

Modified

2026-01-20 05:25

Summary

Details

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-6224	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-6224	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-juju-utils-dev",
            "binary_version": "0.0~git20171220.f38c0b0-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "golang-github-juju-utils",
        "purl": "pkg:deb/ubuntu/golang-github-juju-utils@0.0~git20171220.f38c0b0-4?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0~git20171220.f38c0b0-3",
        "0.0~git20171220.f38c0b0-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-juju-utils-dev",
            "binary_version": "0.0~git20171220.f38c0b0-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "golang-github-juju-utils",
        "purl": "pkg:deb/ubuntu/golang-github-juju-utils@0.0~git20171220.f38c0b0-5?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0~git20171220.f38c0b0-5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-juju-utils-dev",
            "binary_version": "0.0~git20200923.4646bfe-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "golang-github-juju-utils",
        "purl": "pkg:deb/ubuntu/golang-github-juju-utils@0.0~git20200923.4646bfe-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0~git20171220.f38c0b0-6",
        "0.0~git20200923.4646bfe-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-juju-utils-dev",
            "binary_version": "0.0~git20200923.4646bfe-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "golang-github-juju-utils",
        "purl": "pkg:deb/ubuntu/golang-github-juju-utils@0.0~git20200923.4646bfe-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0~git20200923.4646bfe-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-juju-utils-dev",
            "binary_version": "0.0~git20200923.4646bfe-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "golang-github-juju-utils",
        "purl": "pkg:deb/ubuntu/golang-github-juju-utils@0.0~git20200923.4646bfe-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0~git20200923.4646bfe-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.",
  "id": "UBUNTU-CVE-2025-6224",
  "modified": "2026-01-20T05:25:03Z",
  "published": "2025-07-01T11:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-6224"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6224"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-6224"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-6224 (GCVE-0-2025-6224)

FKIE_CVE-2025-6224

GHSA-H34R-JXQM-QGPR

Summary

Details

Background

PoC

Impact

OPENSUSE-SU-2025:15405-1

ubuntu-cve-2025-6224

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature