CVE-2025-6224 - CVE House
Back to Database
Status published Medium CVE-2025-6224

Key leakage in juju/utils certificates

Vulnerability Description

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6224

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Josh McSavaney

References

More from Canonical

View All →
CVE-2025-6966
Null-pointer dereference in python-apt TagSection.keys()
Medium 6.9
CVE-2025-5689
Improper Permission Management in SSH Session Handling
High 8.5
CVE-2025-5467
Ubuntu Apport Insecure File Permissions Vulnerability
Low 1.9
CVE-2025-5199
LPE on Multipass for macOS
High 7.3
CVE-2025-5054
Race Condition in Canonical Apport
Medium 4.7

Affected Vendor

Affected Software

Juju utils
Vulnerable Versions:
4.0.1

Timeline

Official Publish: July 1st, 2025
Last Modified: July 1st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-312

MITRE ATT&CK TTPs

T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1530 Data from Cloud Storage
Collection
T1078 Valid Accounts
Persistence
T1041 Exfiltration Over C2 Channel
Exfiltration