netty-incubator-codec-ohttp-hpke-classes-boringssl Package Vulnerability Alert
- Severity
- HIGH
- Affected component
- io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (maven)
- Affected versions
- < 0.0.23.Final or >= 0.0.10.Final, <= 0.0.10.Final or >= 0.0.11.Final, <= 0.0.11.Final or >= 0.0.12.Final, <= 0.0.12.Final or >= 0.0.13.Final, <= 0.0.13.Final or >= 0.0.14.Final, <= 0.0.14.Final or >= 0.0.15.Final, <= 0.0.15.Final or >= 0.0.16.Final, <= 0.0.16.Final or >= 0.0.17.Final, <= 0.0.17.Final or >= 0.0.18.Final, <= 0.0.18.Final or >= 0.0.19.Final, <= 0.0.19.Final or >= 0.0.20.Final, <= 0.0.20.Final or >= 0.0.21.Final, <= 0.0.21.Final or >= 0.0.22.Final, <= 0.0.22.Final or >= 0.0.3.Final, <= 0.0.3.Final or >= 0.0.4.Final, <= 0.0.4.Final or >= 0.0.5.Final, <= 0.0.5.Final or >= 0.0.6.Final, <= 0.0.6.Final or >= 0.0.7.Final, <= 0.0.7.Final or >= 0.0.8.Final, <= 0.0.8.Final or >= 0.0.9.Final, <= 0.0.9.Final
- Patched version
- Not yet available
The netty-incubator-codec-ohttp-hpke-classes-boringssl Maven package reportedly exposes raw HPKE private key bytes in string representations and error messages. Applications that log key-pair objects or exceptions may persist private key material in logs.
What happened
An early warning has been issued for the netty-incubator-codec-ohttp-hpke-classes-boringssl Maven package. This package appears to expose raw HPKE private key bytes in string representations and error messages. Applications that log key-pair objects or exceptions can potentially persist private key material in logs. This issue is under investigation and has not been exploited in the wild as of the latest reports.
The affected versions include all versions less than 0.0.23.Final or any version between 0.0.10.Final and 0.0.22.Final inclusive. Additionally, versions 0.0.3.Final to 0.0.9.Final are also affected. The issue stems from the toString() method and exception messages that inadvertently expose sensitive key material.
What to do about it
- Upgrade to a version of netty-incubator-codec-ohttp-hpke-classes-boringssl that fixes the issue.
- Review application logs for any exposed private key material.
- Monitor the primary sources for updates on a patched version.
- Ensure that logging practices do not persist sensitive key material.
- Consider implementing additional logging safeguards to prevent future exposure of private keys.
How 0Day would have caught this
io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using netty-incubator-codec-ohttp-hpke-classes-boringssl in versions less than 0.0.23.Final or any version between 0.0.10.Final and 0.0.22.Final inclusive, or versions 0.0.3.Final to 0.0.9.Final.
What should I do right now?
Upgrade to a fixed version of the package and review your logs for any exposed private key material. Monitor the primary sources for updates on a patched version.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.
How can I prevent future exposure of private keys?
Implement additional logging safeguards to ensure sensitive key material is not persisted in logs.