CVE-2025-6224 Key leakage in juju/utils certificates
Attackers can extract private keys from certificates generated by the juju/utils library if transmitted over plaintext networks, compromising security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-6224?
CVE-2025-6224 is a medium-severity vulnerability in Canonical Juju utils, published on 1 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.
Weakness: CWE-312
Which versions are affected by CVE-2025-6224?
6 open source packages ship an affected version, including github.com/juju/utils/v4/cert, github.com/juju/utils and github.com/juju/utils/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/juju/utils/v4/cert Go | All versions | 4.0.4 |
github.com/juju/utils/v4/cert Go | All versions | 4.0.4 |
github.com/juju/utils Go | All versions | None |
github.com/juju/utils/v2 Go | All versions | None |
github.com/juju/utils/v3 Go | All versions | None |
github.com/juju/utils/v4 Go | All versions | 4.0.4 |
Products include Canonical Juju\/Utils.
How do I fix CVE-2025-6224?
Upgrade github.com/juju/utils/v4/cert to 4.0.4 or later.
Is CVE-2025-6224 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6224 exists.
Sources
Also known as GHSA-h34r-jxqm-qgpr, GO-2025-3798, UBUNTU-CVE-2025-6224.