Linux Distros Unpatched Vulnerability : CVE-2025-6224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the netwo...

Cleartext Storage of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information via the cert.NewLeaf function. An attacker can obtain sensitive private key material by intercepting certificates transmitted in plaintext during a TLS handshake, allowing impersonation of eith...

Cleartext Storage of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information via the cert.NewLeaf function. An attacker can obtain sensitive private key material by intercepting certificates transmitted in plaintext during a TLS handshake, allowing impersonation of eith...

juju/utils leaks private key in certs

Summary Certs generated by v4 contain their private key. Details Background Recently, I encountered an API in Go that’s easy to misuse: sha512.Sum384 and sha512.New384.Sum look very similar and behave very differently. https://go.dev/play/p/kDCqqoYk84k demonstrates this. I want to discuss extendi...

CVE-2025-6224 Key leakage in juju/utils certificates

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it...

CVE-2025-6224 Key leakage in juju/utils certificates

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it...

PT-2025-27515 · Unknown · Juju Utils

Name of the Vulnerable Software and Affected Versions: juju/utils affected versions not specified Description: The issue concerns the generation of certificates in juju/utils using the cert.NewLeaf function, which could potentially include private information. If such a certificate is transferred...