CVE-2024-33663: Incomplete Hmac Key Blocklist
A hardcoded, incomplete list of strings (like `-----BEGIN PUBLIC KEY-----`) is used to prevent asymmetric keys from being used as HMAC secrets. This can lead to algorithm confusion vulnerabilities if unhandled key types (e.g., OpenSSH ECDSA) are provided, allowing attackers to forge tokens. Use robust key parsing and format validation instead of string block
Pythongreprules fetch cve-2024-33663-incomplete-hmac-key-blocklist --engine opengrepDescription
A hardcoded, incomplete list of strings (like `-----BEGIN PUBLIC KEY-----`) is used to prevent asymmetric keys from being used as HMAC secrets. This can lead to algorithm confusion vulnerabilities if unhandled key types (e.g., OpenSSH ECDSA) are provided, allowing attackers to forge tokens. Use robust key parsing and format validation instead of string block
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.