Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
guanzhi/gmssl
master @ 6c2b35b
57
Fixes
0
CVEs
HIGH
Peak severity
29.4%
Coverage
Highlights
Auth Bypass: 12 prior fixes. Scrutinize any change in this area.
src/tls13.c: most-fixed (7 issues). Treat as high-risk during review.
33 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple issues in certificate verification bypassed basic constraints, path length constraints, and signature verification, allowing invalid chains to be trusted. Developers should ensure the validation path enforces all standard constraints and checks root CA signatures thoroughly.
Buffer Overflow: Lack of size validation checks prior to memory copies in TLS 1.3 handshakes (such as copying early data, cookies, and PSK) led to heap/stack overflows. Enforcing strict bounds checks before calling memcpy is mandatory.
Cryptographic Weakness: A critical binding issue mapped the AES-128 decryption operation directly to the encryption function instead of the decryption one. This highlights the need for strict correctness checks in cryptographic cipher dispatch tables.