HN 读者分享：Anthropic 在 Pion 中发现 36 个漏洞（6 个 CVE），OpenAI 未发现
1 分•作者: JoTurk•大约 1 小时前
上周，我们将 Pion DTLS 添加到了 Anthropic 的 OSS 扫描器中（https://github.com/anthropics/oss-scanner/pull/93），今天我们醒来时收到一份报告，其中包含 36 个 bug，其中包括 6 个安全漏洞：2 个严重、3 个高危和 1 个中危。其中四个影响 WebRTC。
其中一些漏洞已经存在于代码库中超过 4 年，经历了多年的测试和安全扫描。有趣的是，我们的收件箱总是充斥着使用 Codex 和 Claude 的人发送的 AI 生成的安全报告，其中大部分都标记了毫无意义的问题。然而，它们却一个都没有发现这些漏洞。
最有趣的部分？Anthropic 还发现了 OpenAI 内部代码审查遗漏的 3 个 bug。我曾要求 OpenAI 审查一个新的 DTLS API，因为他们使用 Pion 并且在 SPED 中有使用场景。他们的审查并未发现任何 bug。Anthropic 发现了一个认证问题、一个死锁和一个 TLS KeyUpdate bug（也许他们的模型忽略了它，因为它不是 WebRTC 问题）。幸运的是，该 API 尚未发布。修复方案：https://github.com/pion/dtls/pull/1236
以下是 Anthropic 发现的 CVE 的安全公告（所有这些都早于 ChatGPT！）：
严重：DTLS 握手签名混淆允许对等方冒充 - https://github.com/pion/dtls/security/advisories/GHSA-7c2r-jhm9-43vf
严重：通过过早会话缓存绕过客户端认证 - https://github.com/pion/dtls/security/advisories/GHSA-hhpj-h56m-9f2p
高危：使用共享会话存储绕过客户端认证 - https://github.com/pion/dtls/security/advisories/GHSA-cqhp-ggp7-58qj
高危：无界握手缓存允许远程内存耗尽 - https://github.com/pion/dtls/security/advisories/GHSA-jm57-r6vj-mwg9
高危：过大的 RSA 密钥允许 CPU 耗尽 - https://github.com/pion/dtls/security/advisories/GHSA-jp25-wc3w-p9xp
中危：重复证书验证允许 CPU 耗尽 - https://github.com/pion/dtls/security/advisories/GHSA-qpgj-64qg-5m4r
最令人恼火的是，两家公司的模型都不愿意帮助验证或过滤这些 bug，所以我们不得不逐一手动审查（花了一整天 :/)。
查看原文
We added Pion DTLS to Anthropic's OSS scanner last week (https://github.com/anthropics/oss-scanner/pull/93), and today we woke up to a report with 36 bugs, including 6 security vulnerabilities: 2 critical, 3 high, and 1 moderate. Four of them affect WebRTC.<p>Some of these vulnerabilities have been sitting in the codebase for over 4 years, surviving years of testing and security scans. It's funny that our inboxes are constantly spammed with AI-generated security reports from people using Codex and Claude, most of which flag pointless issues. Yet somehow, none of them caught these.<p>The funniest part? Anthropic also found 3 bugs that OpenAI's internal code review missed. I had asked OpenAI to review a new DTLS API since they use Pion and had a use case for it in SPED. Their review didn't flag any bugs. Anthropic found an authentication issue, a deadlock, and a TLS KeyUpdate bug (Maybe their model ignored this one because it's not a WebRTC issue). Luckily, the API hasn't been released yet. The fixes: https://github.com/pion/dtls/pull/1236<p>Here are the security advisories for the CVEs Anthropic found (all of them are pre-chatgpt!):<p>Critical: DTLS handshake signature confusion allows peer impersonation - https://github.com/pion/dtls/security/advisories/GHSA-7c2r-jhm9-43vf<p>Critical: Client authentication bypass through premature session caching - https://github.com/pion/dtls/security/advisories/GHSA-hhpj-h56m-9f2p<p>High: Client authentication bypass with shared session stores - https://github.com/pion/dtls/security/advisories/GHSA-cqhp-ggp7-58qj<p>High: Unbounded handshake cache allows remote memory exhaustion - https://github.com/pion/dtls/security/advisories/GHSA-jm57-r6vj-mwg9<p>High: Oversized RSA keys allow CPU exhaustion - https://github.com/pion/dtls/security/advisories/GHSA-jp25-wc3w-p9xp<p>Moderate: Repeated certificate verification allows CPU exhaustion - https://github.com/pion/dtls/security/advisories/GHSA-qpgj-64qg-5m4r<p>The most annoying part is that neither company's models were willing to help with verifying or filtering the bugs, so we had to manually review them one by one (Spent all day :/