by Kastro
Paper/Archive/CVE-2024-36121

CVE-2024-36121

netty netty-incubator-codec-ohttp — netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats Nonces

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
31
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 19.1.191 × 203.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which would allow an attacker to cause the sequence number to overflow and thus the nonce to repeat.

Affected

ProductAffectedFixed inSource
netty-incubator-codec-ohttp>= 0.0.3.Final, < 0.0.11.Final–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-g762-h86w-8749refgithub.com/netty/netty-incubator-codec-ohttp/blob/1ddadb6473cd3be5491d114431ed4c1a9f316001/codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAEADContext.java#L112-L114