google / google/conscrypt

Possible Security Issue in org/conscrypt/Platform.java

Open
#910 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
1.4k
Forks
326
Avg merge
16h 22m
Merged PRs (30d)
17

Description

Hi,

It looks like function _OpenSSLKey_ of [Platform.java](https://github.com/google/conscrypt/blob/master/android/src/main/java/org/conscrypt/Platform.java) exposes private key in log. The code can be found in both 2.5.x version and master branch.

`
if (opensslKey == null) {
// Bail when detecting OEM "enhancement".
Log.e(TAG, "Could not getOpenSSLKey on instance: " + javaKey.toString());
return null;
}
`

Thanks.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.