-
Notifications
You must be signed in to change notification settings - Fork 0
Open
Description
From https://github.com/balena-io-security/security-reviews/blob/main/2022/11-15-2022-balena-sign.md
Keys are handled without being treated as secure for memory purposes. When loading keys into memory, the variables should be loaded as bytearrays to allow us to overwrite the elements of the bytearray, then del the reference. Even if the object were to resurface at that point, it would be filled with gibberish. This protects against retrieving the key from running process memory outside of a limited window.
Refactor key handling on the application
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels