| id: GO-2025-3798 |
| modules: |
| - module: github.com/juju/utils |
| vulnerable_at: 0.0.0-20200604140309-9d78121a29e0 |
| - module: github.com/juju/utils/v2 |
| vulnerable_at: 2.0.0-20210305225158-eedbe7b6b3e2 |
| - module: github.com/juju/utils/v3 |
| vulnerable_at: 3.2.3 |
| - module: github.com/juju/utils/v4 |
| versions: |
| - fixed: 4.0.4 |
| vulnerable_at: 4.0.3 |
| packages: |
| - package: github.com/juju/utils/v4/winrm |
| symbols: |
| - X509.write |
| - ClientConfig.Validate |
| - NewX509 |
| - newCredentials |
| - X509.CACert |
| - Client.Secure |
| - X509.ClientKey |
| - confExists |
| - Client.Password |
| - TTYGetPasswd |
| - ClientConfig.password |
| - X509.ClientCert |
| - X509.LoadCACert |
| - Client.Ping |
| - X509.Reset |
| - NewClient |
| - Client.Run |
| - X509.LoadClientCert |
| - X509.read |
| - package: github.com/juju/utils/v4/cert |
| symbols: |
| - newSerialNumber |
| - getPublicKey |
| - NewClientCert |
| - NewLeaf |
| - bigIntHash |
| - NewCA |
| summary: Leaks private key in certs in github.com/juju/utils |
| cves: |
| - CVE-2025-6224 |
| ghsas: |
| - GHSA-h34r-jxqm-qgpr |
| references: |
| - advisory: https://github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr |
| - fix: https://github.com/juju/utils/commit/766f27d7bcd10433453a9764509a864c17a46a76 |
| - web: https://github.com/juju/utils/releases/tag/v4.0.4 |
| source: |
| id: GHSA-h34r-jxqm-qgpr |
| created: 2025-07-21T16:55:29.246172196Z |
| review_status: REVIEWED |
