Skip to content

Ai security fixes#130

Open
lauris71 wants to merge 24 commits into
open-eid:masterfrom
lauris71:ai-security
Open

Ai security fixes#130
lauris71 wants to merge 24 commits into
open-eid:masterfrom
lauris71:ai-security

Conversation

@lauris71

Copy link
Copy Markdown
Contributor

Fixes most critical and high security bugs found by Claude/DeepSeek/GLM/Gwen

  • Peer certificates can only be ignored by compile-time flag
  • Sensitive info logging can only be enabled by compile-time keys
  • Random number entropy failure returns error
  • AESWrap handles error/success correctly
  • Disable Bleichenbacher attack vector for CDoc1 RSA keys
  • Always log out PKCS11 sessions
  • Fix path-traversal in extracted filenames
  • Limit maximum PAX header size
  • Keep secrets in secured memory
  • Require https protocol for key/share servers
  • and more...

Signed-off-by: Lauris Kaplinski lauris@raulwalter.com

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant