Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
oasisprotocol/oasis-core
master @ cd5651b
99
Fixes
0
CVEs
HIGH
Peak severity
35.5%
Coverage
Highlights
Auth Bypass: 57 prior fixes. Scrutinize any change in this area.
keymanager: most-fixed (6 issues). Treat as high-risk during review.
68 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The keymanager is highly susceptible to state freshness bypasses where clients can query secrets against unverified or outdated consensus states, or when heights are not validated. This can allow unauthorized retrieval of ephemeral or master secrets.
Information Disclosure: Cryptographic operations in the CHURP and secret-sharing components have historically left sensitive intermediate values (like bivariate polynomials and Lagrange products) in memory, requiring explicit zeroization on drop.
Auth Bypass: Node and runtime registration flaws allowed unverified or improperly signed metadata to populate the registry state, facilitating node spoofing. Fixes mandated multi-signatures and verification of associated entities.