2 results · Feed
-
High —
openmls has improper tag validation
Membership and confirmation tags may not be checked correctly due to a missing length check. Any tag that is shorter than the expected tag, but matches up to its length, as well as any empty tag is considered valid. ### Impact The vulnerability affects a seco…
-
Medium —
OpenMLS improper persistence of the secret tree during message processing
### Summary A bug in the OpenMLS library prevented private key material from being updated in storage during message processing. The key material in question are the keys stored in the MLS secret tree, which are used for decryption of private MLS messages. Th…