CVE-2025-6224CWE-312

Key leakage in juju/utils certificates

Medium · published July 1, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.6th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2025-07-01T10:39Z
EPSS history
Timeline
  • 01 JUL 10:39Z
    Key leakage in juju/utils certificates
    cvelistv5