CVE-2024-36121
Medium
Description
netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which would allow an attacker to cause the sequence number to overflow and thus the nonce to repeat.
SeverityMedium
CVSS5.9
Exploit probability—
ProductNetty-incubator-codec-ohttp
PublishedJun 4, 2024
First seenJun 4, 2024
How to fix
Update
- netty netty-incubator-codec-ohttp0.0.11 or later
- io.netty.incubator:netty-incubator-codec-ohttp0.0.11.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netty netty-incubator-codec-ohttp | 0.0.3 ≤ v < 0.0.11 | 0.0.11 |
| io.netty.incubator:netty-incubator-codec-ohttpMaven | 0.0.3.Final ≤ v < 0.0.11.Final | 0.0.11.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.