Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tink-crypto/tink

              master @ 1f4cd38
            

124

Fixes

CVEs

CRITICAL

Peak severity

39.5%

Coverage

Highlights

Cryptographic Issues: 35 prior fixes. Scrutinize any change in this area.

cc/subtle: most-fixed (4 issues). Treat as high-risk during review.

44 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Lenient header and parameter validation, specifically the omission of strict key ID ('kid') checking and token type ('typ') validation, allowed signature verification bypasses across multiple language bindings. This permitted attackers to forge or repurpose tokens using mismatched keys in a keyset.

Cryptographic Issues: Failure to validate that public key coordinates reside on the associated curve allowed invalid curve and peer parameter attacks during ECDH and ECDSA operations. This can lead to private key recovery or signature forgery.

Auth Bypass: Failing to bind the decrypt request explicitly to the configured expected Key ARN/URI allowed ciphertexts generated by untrusted or unauthorized AWS KMS keys to be decrypted, bypassing cryptographic isolation boundaries.