Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the insecure logging of sensitive cryptographic key material. The toString() methods of BoringSSLAsymmetricCipherKeyPair and BoringSSLAsymmetricKeyParameter were implemented in a way that exposed the raw byte representation of the private key. When these objects were logged, their toString() method would be called, causing the private key to be written to the log files. Additionally, the EVP_HPKE_KEY_init_or_throw method in the BoringSSL class would include the private key in an exception message upon initialization failure. The patch addresses this by redacting the private key material from the output of these methods, preventing the sensitive information from being logged.
io.netty.incubator.codec.hpke.boringssl.BoringSSL.EVP_HPKE_KEY_init_or_throwcodec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java
io.netty.incubator.codec.hpke.boringssl.BoringSSLAsymmetricCipherKeyPair.toStringcodec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java
io.netty.incubator.codec.hpke.boringssl.BoringSSLAsymmetricKeyParameter.toStringcodec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl | maven | <= 0.0.22.Final | 0.0.23.Final |
Because Java logging frameworks commonly call toString() for structured objects and commonly persist exception messages, these paths can place complete HPKE private key material in logs or telemetry.
Safe local verification was performed without native BoringSSL by compiling the relevant Java classes and a no-op native stub for the unused finalizer reference. The observed output includes the full private key byte array:
BoringSSLAsymmetricCipherKeyPair{privateKey=BoringSSLAsymmetricKeyParameter{bytes=[1, 2, 3, 4], isPrivate=true}, publicKey=BoringSSLAsymmetricKeyParameter{bytes=[5, 6, 7, 8], isPrivate=false}}
Minimal reproducer concept in the same package:
package io.netty.incubator.codec.hpke.boringssl;
public final class VerifyPrivateKeyToString {
public static void main(String[] args) {
byte[] privateKey = new byte[] {1, 2, 3, 4};
byte[] publicKey = new byte[] {5, 6, 7, 8};
BoringSSLAsymmetricCipherKeyPair pair = new BoringSSLAsymmetricCipherKeyPair(privateKey, publicKey);
System.out.println(pair.toString());
}
}
The code path is deterministic: the production toString() methods concatenate the raw private-key byte array.
If an affected key pair or initialization exception is logged, application logs contain complete HPKE private key material. Anyone with access to those logs can recover the key. Depending on key reuse and log retention, this can compromise:
BoringSSLAsymmetricKeyParameter.toString() when isPrivate is true, for example bytes=<redacted> or only key type/length.privateKey in BoringSSLAsymmetricCipherKeyPair.toString().Arrays.toString(privateKeyBytes) from BoringSSL.EVP_HPKE_KEY_init_or_throw(...); report only length and KEM metadata.toString() and exception messages do not contain private key byte values.toString() for sensitive material entirely.codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java:72-78codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java:70-76codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java:228-232