Tell HN: Anthropic found 36 bugs (6 CVEs) in Pion, OpenAI missed them

Anthropic's OSS scanner found 36 bugs, including 6 CVEs (2 critical, 3 high, 1 moderate), in the Pion DTLS codebase after the tool was added to the project last week, according to a Hacker News post by the scanner's integrator. Four of the vulnerabilities affect WebRTC, some have sat in the codebase for over 4 years, and Anthropic also found 3 bugs that OpenAI's internal code review missed on an unreleased DTLS API used in SPED. Fixes are in pion/dtls pull request 1236.

We added Pion DTLS to Anthropic's OSS scanner last week https://github.com/anthropics/oss-scanner/pull/93 , and today we woke up to a report with 36 bugs, including 6 security vulnerabilities: 2 critical, 3 high, and 1 moderate. Four of them affect WebRTC. Some of these vulnerabilities have been sitting in the codebase for over 4 years, surviving years of testing and security scans. It's funny that our inboxes are constantly spammed with AI-generated security reports from people using Codex and Claude, most of which flag pointless issues. Yet somehow, none of them caught these. The funniest part? Anthropic also found 3 bugs that OpenAI's internal code review missed. I had asked OpenAI to review a new DTLS API since they use Pion and had a use case for it in SPED. Their review didn't flag any bugs. Anthropic found an authentication issue, a deadlock, and a TLS KeyUpdate bug Maybe their model ignored this one because it's not a WebRTC issue . Luckily, the API hasn't been released yet. The fixes: https://github.com/pion/dtls/pull/1236 Here are the security advisories for the CVEs Anthropic found all of them are pre-chatgpt : Critical: DTLS handshake signature confusion allows peer impersonation - https://github.com/pion/dtls/security/advisories/GHSA-7c2r-jhm9-43vf Critical: Client authentication bypass through premature session caching - https://github.com/pion/dtls/security/advisories/GHSA-hhpj-h56m-9f2p High: Client authentication bypass with shared session stores - https://github.com/pion/dtls/security/advisories/GHSA-cqhp-ggp7-58qj High: Unbounded handshake cache allows remote memory exhaustion - https://github.com/pion/dtls/security/advisories/GHSA-jm57-r6vj-mwg9 High: Oversized RSA keys allow CPU exhaustion - https://github.com/pion/dtls/security/advisories/GHSA-jp25-wc3w-p9xp Moderate: Repeated certificate verification allows CPU exhaustion - https://github.com/pion/dtls/security/advisories/GHSA-qpgj-64qg-5m4r The most annoying part is that neither company's models were willing to help with verifying or filtering the bugs, so we had to manually review them one by one Spent all day :/ Comments URL: https://news.ycombinator.com/item?id=50124600 https://news.ycombinator.com/item?id=50124600 Points: 4 Comments: 1