Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tomitribe/http-signatures-java

              master @ 51027f6
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

src/main/java/org/tomitribe/auth/signatures/Signature.java: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Signature validity parameters (created and expires) were previously unvalidated, leading to potential authentication bypasses via signature replay attacks of expired or post-dated messages.

Auth Bypass: Incomplete cryptographic validation where the computed MAC hash was compared directly instead of being properly Base64 encoded, causing signature verification to fail or be bypassed.

Timing Attack: Use of non-constant-time byte array comparisons (Arrays.equals) allowed attackers to exploit timing side-channels to reconstruct valid signatures.