‹ BackHN Continuity

Thread

Xray-core concealed a certificate verification bypass vulnerability

75 points · 10 comments · timbill

  1. eriwang915 · · focus · HN ↗
    Xray-core's pinnedPeerCertSha256 treated an inserted leaf as the pinned cert, and the fix commit never called it a vulnerability.
    1. LoganDark · · focus · HN ↗
      Your LLM left out the clear hypocrisy and the part where the fixed version still had a vulnerability
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.