PT-2024-26908 · Unknown · Netty-Incubator-Codec-Ohttp

Salusasecondus · Published 2024-06-04 · Updated 2024-06-11 · CVE-2024-36121

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions netty-incubator-codec-ohttp (affected versions not specified)

Description The issue arises from two separate errors in BoringSSLAEADContext, which keeps track of the number of OHTTP responses sent to calculate the nonce for the encryption algorithm. These errors can cause the sequence number to overflow, resulting in a repeated nonce. The sequence number is stored as a 32-bit int, making it relatively easy to overflow, and there is no overflow detection or enforcement of the maximum sequence value. If the BoringSSLAEADContext is used to encrypt more than 2^32 messages, the AES-GCM nonce will repeat, compromising both confidentiality and integrity of the encrypted data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Information Disclosure

Weakness Enumeration

CWE-190

CWE-200

CWE-323

Related Identifiers

CVE-2024-36121

GHSA-G762-H86W-8749

Affected Products

Netty-Incubator-Codec-Ohttp

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36121.json · Exploit
• 🔥 https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-g762-h86w-8749 · Exploit
• https://osv.dev/vulnerability/CVE-2024-36121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36121 · Security Note
• https://osv.dev/vulnerability/GHSA-g762-h86w-8749 · Vendor Advisory
• https://github.com/netty/netty-incubator-codec-ohttp/blob/1ddadb6473cd3be5491d114431ed4c1a9f316001/codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAEADContext.java#L112-L114 · Note
• https://github.com/netty/netty-incubator-codec-ohttp · Note
• https://t.me/cvenotify/82843 · Telegram Post