Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/juju/utils/v4/cert

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5GoPublished

    juju/utils leaks private key in certs

    CVE-2025-6224 · GHSA-h34r-jxqm-qgpr

    Affected
    • Go github.com/juju/utils/v4/cert <= 4.0.3
    Fixed in
    4.0.4· Vendor fix available
    Issue
    Certs generated by v4 contain their private key. Details Background Recently, I encountered an API in Go that’s easy to misuse: sha512.Sum384 and sha512.New384().Sum look very similar and behave very differently. https://go.dev/play/p/kDCqqoYk84k demonstrates this. I want to discuss extending static analysis to detect this case with the go community, but before I do that, I want to make a best-effort pass at open-source projects to fix the existing bugs. I figured that if there were any vulnerabilities out there, they would be easy to find once that discussion begins, so it’s better to address them early. This work is a hobby project and has no affiliation with my employer, so I may be slow to respond due to existing commitments. PoC https://go.dev/play/p/vSW0U3Hq4qk Impact This code (cert.NewLeaf) generates certs with the SubjectKeyId set to sha512.New384().Sum(/ private / key). If a cert which was generated by cert.NewLeaf is transferred over the network in plaintext, as is…

    Recommended action: Upgrade to 4.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →