https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 08:08:43 +0000 https://cve.radiocsirt.org/vuln/ghsa-2mc4-j865-9q4r <p><strong>Affected:</strong> Maven: io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl</p> <p>## Summary</p> <p>`io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` exposes raw HPKE private key bytes in string representations and error messages. `BoringSSLAsymmetricCipherKeyPair.toString()` includes the private-key parameter object, and `BoringSSLAsymmetricKeyParameter.toString()` renders the full byte array with `Arrays.toString(bytes)`. Separately, failed native key initialization includes `Arrays.toString(privateKeyBytes)` in the thrown `IllegalArgumentException` message. Applications that log key-pair objects or exceptions can persist private key material in logs.</p> <p>## Details</p> <p>`codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java` renders private key material through `toString()`:</p> <p>- `BoringSSLAsymmetricCipherKeyPair.toString()` at lines 72-78 concatenates `&#34;privateKey=&#34; + privateKey`. - `privateKey` is a `BoringSSLAsymmetricKeyParameter` created with `isPrivate=true` at lines 26-36.</p> <p>`codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java` then renders all bytes:</p> <p>- `BoringSSLAsymmetricKeyParameter.toString()` at lines 70-76 returns `&#34;bytes=&#34; + Arrays.toString(bytes)` regardless of whether `isPrivate` is true.</p> <p>A separate error path in `codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java` also exposes caller-provided private key bytes:</p> <p>- `EVP_HPKE_KEY_ini…</p> <p><strong>Affected:</strong> Maven: io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl</p> <p>## Summary</p> <p>`io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` exposes raw HPKE private key bytes in string representations and error messages. `BoringSSLAsymmetricCipherKeyPair.toString()` includes the private-key parameter object, and `BoringSSLAsymmetricKeyParameter.toString()` renders the full byte array with `Arrays.toString(bytes)`. Separately, failed native key initialization includes `Arrays.toString(privateKeyBytes)` in the thrown `IllegalArgumentException` message. Applications that log key-pair objects or exceptions can persist private key material in logs.</p> <p>## Details</p> <p>`codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java` renders private key material through `toString()`:</p> <p>- `BoringSSLAsymmetricCipherKeyPair.toString()` at lines 72-78 concatenates `&#34;privateKey=&#34; + privateKey`. - `privateKey` is a `BoringSSLAsymmetricKeyParameter` created with `isPrivate=true` at lines 26-36.</p> <p>`codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java` then renders all bytes:</p> <p>- `BoringSSLAsymmetricKeyParameter.toString()` at lines 70-76 returns `&#34;bytes=&#34; + Arrays.toString(bytes)` regardless of whether `isPrivate` is true.</p> <p>A separate error path in `codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java` also exposes caller-provided private key bytes:</p> <p>- `EVP_HPKE_KEY_ini…</p> https://cve.radiocsirt.org/vuln/ghsa-2mc4-j865-9q4r