CVE-2025-6224: juju/utils leaks private key in certs

July 1, 2025

Certs generated by v4 contain their private key.

References

github.com/advisories/GHSA-h34r-jxqm-qgpr
github.com/juju/utils
github.com/juju/utils/commit/766f27d7bcd10433453a9764509a864c17a46a76
github.com/juju/utils/releases/tag/v4.0.4
github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr
nvd.nist.gov/vuln/detail/CVE-2025-6224

Code Behaviors & Features

Detect and mitigate CVE-2025-6224 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →