Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
build-trust/ockam
develop @ 0435d8d
108
Fixes
0
CVEs
CRITICAL
Peak severity
24.2%
Coverage
Highlights
Auth Bypass: 55 prior fixes. Scrutinize any change in this area.
ockam_api: most-fixed (15 issues). Treat as high-risk during review.
65 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: A critical flaw in the identity change-history processor unconditionally allowed updates even when signature verification failed or returned missing values. This effectively nullified the trust guarantees of identity state transitions.
Auth Bypass: A vulnerability in identity verification allowed potential signature bypasses due to the truncation of identity hashes during cryptographic verification. This was fixed by enforcing full SHA256 hashes and explicit data type checks.
Auth Bypass: The authenticator failed to isolate member storage by authority ID, which allowed credentials and member records to cross over between different authorities, resulting in privilege crossover.