Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
protonmail/go-crypto
main @ d642649
15
Fixes
0
CVEs
HIGH
Peak severity
42.9%
Coverage
Highlights
Auth Bypass: 9 prior fixes. Scrutinize any change in this area.
openpgp: most-fixed (4 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inconsistent or missing checks on key expiration, subkey bindings, self-signature flags, and revocation states can lead to the acceptance of expired or revoked keys for encryption, decryption, and signature verification operations. High-severity fixes across multiple core entry points were required to unify these validation rules.
Auth Bypass: Validating subkey binding signatures against the incorrect key (such as matching signature details against the subkey itself instead of the primary signing key) bypasses trust delegation and allows unauthorized subkeys to assert valid bindings.
Signature Verification Bypass: Using mismatching hash algorithms or incorrect public key parameters when checking subkey revocation signatures fails to verify the true primary key's intent, leading to signature verification bypasses.