Xray-core concealed a certificate verification bypass vulnerability

 (github.com)

54 points | by timbill 8 hours ago

2 comments

  • eriwang915 1 hour ago
    Xray-core's pinnedPeerCertSha256 treated an inserted leaf as the pinned cert, and the fix commit never called it a vulnerability.
  • cryptolobster 1 hour ago
    The reaction to Xray-core is disappointing