netty-incubator-codec-ohttp-hpke-classes-boringssl Vulnerability: Key Exposure Risk
- Severity
- HIGH
- Affected component
- io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (maven)
- Affected versions
- < 0.0.23.Final or >= 0.0.10.Final, <= 0.0.10.Final or >= 0.0.11.Final, <= 0.0.11.Final or >= 0.0.12.Final, <= 0.0.12.Final or >= 0.0.13.Final, <= 0.0.13.Final or >= 0.0.14.Final, <= 0.0.14.Final or >= 0.0.15.Final, <= 0.0.15.Final or >= 0.0.16.Final, <= 0.0.16.Final or >= 0.0.17.Final, <= 0.0.17.Final or >= 0.0.18.Final, <= 0.0.18.Final or >= 0.0.19.Final, <= 0.0.19.Final or >= 0.0.20.Final, <= 0.0.20.Final or >= 0.0.21.Final, <= 0.0.21.Final or >= 0.0.22.Final, <= 0.0.22.Final or >= 0.0.3.Final, <= 0.0.3.Final or >= 0.0.4.Final, <= 0.0.4.Final or >= 0.0.5.Final, <= 0.0.5.Final or >= 0.0.6.Final, <= 0.0.6.Final or >= 0.0.7.Final, <= 0.0.7.Final or >= 0.0.8.Final, <= 0.0.8.Final or >= 0.0.9.Final, <= 0.0.9.Final
- Patched version
- Not yet available
An early warning has been issued regarding the netty-incubator-codec-ohttp-hpke-classes-boringssl Maven package. This package reportedly exposes raw HPKE private key bytes in string representations and error messages.
What happened
The netty-incubator-codec-ohttp-hpke-classes-boringssl Maven package is under investigation for exposing raw HPKE private key bytes. This exposure occurs through the toString() method and exception messages. Applications that log key-pair objects or exceptions can inadvertently persist private key material in logs.
The affected versions include all releases prior to 0.0.23.Final and specific versions between 0.0.10.Final and 0.0.22.Final. Engineers using this package should review their logging practices to ensure private key material is not being logged.
What to do about it
- Avoid logging key-pair objects or exceptions that may contain private key material.
- Monitor logs for any exposed private key bytes.
- Review the use of the netty-incubator-codec-ohttp-hpke-classes-boringssl package in your applications.
- Consult the primary sources for the latest information and updates on this vulnerability.
How 0Day would have caught this
io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using the netty-incubator-codec-ohttp-hpke-classes-boringssl Maven package in versions prior to 0.0.23.Final or specific versions between 0.0.10.Final and 0.0.22.Final.
What should I do right now?
Immediately review your logging practices to ensure private key material is not being logged. Monitor your logs for any exposed private key bytes.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.
How can I stay informed about this issue?
Consult the primary sources and official advisories for the latest information and updates on this vulnerability.