Maven/io.netty.incubator:netty-incubator-codec-ohttp CVE-2024-36121: medium 5.9, EPSS 0.27%
BoringSSLAEADContext in Netty Repeats Nonces
Action: Upgrade io.netty.incubator:netty-incubator-codec-ohttp to 0.0.11.Final or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.0.3.Final | 0.0.11.Final | - |
Fixed versions
| 0.0.11.Final |
Sources
- osv: GHSA-g762-h86w-8749
- https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-g762-h86w-8749
- https://nvd.nist.gov/vuln/detail/CVE-2024-36121
- https://github.com/netty/netty-incubator-codec-ohttp
- https://github.com/netty/netty-incubator-codec-ohttp/blob/1ddadb6473cd3be5491d114431ed4c1a9f316001/codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAEADContext.java#L112-L114
CVE-2024-36121 · published · modified · JSON