Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ethereum/eth-keys
main @ 9ad24c7
3
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Cryptographic Key Validation: 2 prior fixes. Scrutinize any change in this area.
eth_keys/validation.py: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Cryptographic Key Validation: Historically, private keys were accepted without checking they fall within the valid secp256k1 scalar range [1, N-1], which could lead to invalid or weak keys being used in cryptographic operations.
Cryptographic Key Validation: Compressed public keys were accepted without verifying the first byte is 0x02 or 0x03, allowing malformed keys to enter the system and potentially cause incorrect or insecure behavior.
Supply Chain: The build-time dependency 'wheel' was not pinned to a version that fixes a ReDoS vulnerability, exposing the build process to a denial-of-service risk during package installation.