Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wbond/oscrypto

              master @ 1547f53
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Cryptographic Issues: 2 prior fixes. Scrutinize any change in this area.

oscrypto/_mac/tls.py: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Memory Corruption: Misaligned structural widths (uint32 vs uint16) when invoking native Security framework APIs on macOS can result in memory corruption or application crashes during TLS socket initialization. Future changes to platform bindings must rigorously verify C-struct definitions.

Cryptographic Issues: Truncation of leading zero bytes during PBKDF2 intermediate block conversion weakens cryptographic entropy and compromises key derivation integrity. Serialized integer-to-byte routines must always pad to the explicit block size.

Insecure TLS Configuration: Failure to validate administrative or platform-specific certificate validity constraints (such as lifetime limits) on macOS allows potentially insecure or long-lived certificates to be trusted.