Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
rustcrypto/formats
master @ ae7f22a
7
Fixes
5
CVEs
CRITICAL
Peak severity
71.4%
Coverage
Highlights
Cryptographic Issues: 2 prior fixes. Scrutinize any change in this area.
ssh-key: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Insecure Deserialization: Parsing TLS byte vectors incorrectly skipped checking boundaries relative to the length-prefix offset, potentially leading to incorrect deserialization or out-of-bounds slice behaviors. Strict deserialization of vector length-prefixes is vital.
Auth Bypass: Faulty bitmask comparisons in certificate validation helpers allowed KeyUsage checks to pass incorrectly, undermining authorization decisions on validated certificates.
Signature Malleability: Failing to validate the final block of unpadded Base64 variants allowed non-canonical representations to be parsed, presenting signature malleability and transport-layer equivalence risks.