disclude.ioPyPI / cryptography / 50.0.2
cryptography 50.0.2
- Source
- https://github.com/pyca/cryptography
- Artifact scanned
cryptography-50.0.2.tar.gz- Compared with
cryptography-50.0.1.tar.gz(0 signals introduced since)- Files
- 456 scanned, 29 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 89 info
- Scan time
- 67.6 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 87 of 87 warn and critical signals; 87 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-22 23:22
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
= =likely benign Sphinx conf.py execs the project's own __about__.py to read the version string.Reasoning
The exec reads cryptography's own __about__.py from the repository's src tree into a dict to get the version. This is a common Sphinx conf.py idiom for reading version metadata without importing the package. The expression is non-literal, but the file path is local and fixed, with no network or download step.
-
dismissed Example PEM public key embedded in FAQ documentation.
Reasoning
The blob is a PEM-armoured public key sample in an RST documentation file, shown for explanation. Documentation key samples are expected, and the raw pass has a high false-positive rate for base64 text.
-
dismissed Illustrative PEM RSA private key in serialization documentation.
Reasoning
This is an example PEM RSA private key shown in the cryptography serialization docs. It is illustrative text for readers, not a real secret or a hidden payload.
-
dismissed Illustrative PEM public key in serialization documentation.
Reasoning
This is a documentation example of a PEM public key, which is standard for a serialization guide.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:38:11dismissed Example DER key bytes decoded in a documentation code sample.Reasoning
The base64 lines are DER bytes passed to base64.b64decode inside a documentation code example showing how to load a key. The data is an example key, and the code is ordinary library usage.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:53:11dismissed Example public DER key decoded in a documentation code sample.Reasoning
This is the same kind of documentation example as the other base64.b64decode key samples, showing the public-key DER form.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:54:11dismissed Continuation of an example key blob in a documentation sample.Reasoning
This continuation of the documentation example key data is a standard illustrative snippet with no execution or hidden payload.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:55:11dismissed Final lines of an example key blob in a documentation sample.Reasoning
This is the closing part of the same documentation example key blob, with no indication of malicious use.
-
dismissed Illustrative PEM DH parameters in serialization documentation.
Reasoning
This is a PEM-armoured DH parameters example in documentation, shown to explain the serialization format.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:75:11dismissed Example DH parameter DER decoded in a documentation sample.Reasoning
The base64 is DH parameter DER data passed to b64decode in a documentation example. The embedded newlines are part of the illustrative text and do not change its purpose.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:76:16dismissed Continuation of an example DH parameter blob in documentation.Reasoning
This is a continuation of the same DH parameter documentation example, with no execution or hidden logic.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:387:13dismissed Example ssh-rsa public key in serialization documentation.Reasoning
This is an OpenSSH ssh-rsa public key example in documentation, a normal format illustration.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:458:38dismissed Documentation example containing an ed25519 SSH public key string.Reasoning
Raw-pass base64 hit on a public SSH key literal in a documentation example for load_ssh_public_key. Public key material in docs is expected and carries no execution or exfiltration risk.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:477:5dismissed Example OpenSSH PRIVATE KEY PEM block shown in documentation.Reasoning
Raw-pass hit on a sample OpenSSH private key block in the cryptography serialization docs. It is a placeholder/example key used to illustrate loading formats, not a credential being used or exfiltrated.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:1168:5dismissed Example EC PRIVATE KEY PEM block in documentation.Reasoning
A PEM-encoded EC private key sample in the serialization docs. The base64 is ordinary ASN.1/PEM structure for an example key, typical of crypto library documentation.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:1176:5dismissed Example X.509 CERTIFICATE PEM block in documentation.Reasoning
Sample self-signed certificate PEM in the cryptography docs; the encoded blob is standard DER-in-base64 for a test certificate illustrating load functions.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:1189:5dismissed Example X.509 CERTIFICATE PEM block in documentation.Reasoning
Sample certificate PEM in the serialization docs, a standard encoded certificate with no executable or obfuscated payload.
-
info
warn→ info by reviewencoding-base64docs/hazmat/primitives/asymmetric/serialization.rst:1220:5dismissed Example RSA PRIVATE KEY PEM block in documentation.Reasoning
A large PKCS#8 RSA private key sample in documentation. High base64 density is expected for an RSA key; it is a documentation example, not a payload.
-
dismissed Example X.509 CERTIFICATE PEM block in OCSP documentation.
Reasoning
A real-looking certificate chain PEM in OCSP documentation, used as sample input for OCSP response parsing. Standard certificate encoding in a docs file, with no code execution.
-
dismissed Example X.509 CERTIFICATE PEM block in OCSP documentation.
Reasoning
Certificate PEM sample in the OCSP docs, an ordinary encoded certificate used to illustrate the API.
-
dismissed Example X.509 CERTIFICATE PEM block in documentation.
Reasoning
Example self-signed certificate PEM in the OCSP docs. The blob is standard certificate encoding with no hidden logic.
-
dismissed Example EC PRIVATE KEY PEM block in documentation.
Reasoning
Example EC PRIVATE KEY PEM block in the OCSP docs, a sample key illustrating loading. Benign documentation content.
-
dismissed Base64 output of an OCSP request DER example in documentation.
Reasoning
Docs show base64.b64encode of a DER-encoded OCSP request in an interactive session. The output is a plain encoded request, a legitimate example of the API.
-
likely benign Example X509 CRL in PEM form inside reference documentation.
Reasoning
The blob is a PEM-armored X.509 CRL shown as a documentation example. Base64 of ASN.1 structures in reference docs is expected and carries no payload or obfuscation.
-
likely benign Example certificate signing request in PEM form in documentation.
Reasoning
A PEM certificate request block in API docs, with the expected base64 structure of a CSR. The raw pass flags any long base64 run, and this is documentation content.
-
likely benign Example X.509 certificate in PEM form in documentation.
Reasoning
A sample PEM certificate in reference documentation. Standard test/example data, not an encoded dropper or hidden payload.
-
likely benign Example PEM certificate in documentation.
Reasoning
A real-looking PEM certificate illustrating the API. Its base64 is ASN.1 DER content and matches typical documentation examples.
-
likely benign Example RSA public key in PEM form in documentation.
Reasoning
An RSA public key in PEM form in documentation. Key material examples are expected in a cryptography library's docs.
-
likely benign Example PEM certificate with issuer in documentation.
Reasoning
A PEM certificate with an issuer name in documentation, matching a standard example. Nothing executes and no hidden content is present.
-
likely benign Example PEM certificate with signature-algorithm content in documentation.
Reasoning
A PEM certificate in docs. The repeated OID-like pattern is consistent with a test certificate for signature-algorithm examples, not obfuscated code.
-
likely benign Example PEM certificate in certificate verification documentation.
Reasoning
A Let's Encrypt-style PEM certificate in verification documentation, a typical illustrative example in a crypto library's docs.
-
likely benign Example ISRG root certificate in PEM form in documentation.
Reasoning
A PEM certificate from an ISRG root chain in verification docs. Illustrative certificate data, not a payload.
-
likely benign Build helper that execs the project's own __about__.py to load version metadata.
Reasoning
This is cryptography's cffi build helper. It reads the project's own __about__.py and execs it to obtain the version metadata. The argument is a local file path, not attacker-supplied input, and the pattern is a known idiom for version loading. The critical severity overstates it, but a non-literal exec at import time still warrants a note.
-
=likely benign Dynamic import of the project's own _cffi_src modules by name.Reasoning
The helper imports a list of the project's own cffi binding modules by prefix and name, then reads them from sys.modules. The dynamic import is over a fixed list of local module names, consistent with cffi module loading rather than remote or hidden code.
-
= -
, ]likely benign PKCS#12 KDF test vector with binary constants written as hex escapes.Reasoning
The byte literals are PKCS#12 key-derivation test vectors (a password of 0xFF bytes, a salt, and an expected output), in a test table. Long hex escape runs are normal for binary test data in a crypto crate.
-
info
warn→ info by reviewencoding-base64src/rust/cryptography-x509-verification/src/certificate.rs:32:1"-----BEGIN CERTIFICATE----- MIIBUTCB96ADAgECAgIDCTAKBggqhkjOPQQDAjAnMQswCQYDVQQGEwJVUzEYMBYG A1UEAwwPY3J5cHRvZ3JhcGh5IENBMB4XDTE3MDEwMTEyMDEwMFoXDTM4MTIzMTA4 MzAwMFowJzELMAkGA1UEBhMCVVMxGDAWBgNVBAMMD2NyeXB0b2dyYXBoeSBDQTBZlikely benign Embedded PEM certificate blob in a certificate verification test.Reasoning
This is a PEM-encoded X.509 certificate with a BEGIN CERTIFICATE header, inside a verification crate's source, most likely as a test fixture. Base64 certificate data is expected there and carries no executable content.
-
"-----BEGIN CERTIFICATE----- MIIBcjCCARmgAwIBAgIBATAKBggqhkjOPQQDAjAhMR8wHQYDVQQDDBZsb29waW5n IHNlbGYtc2lnbmVkIENBMB4XDTIzMTIzMTAwMDAwMFoXDTI0MDEzMTAwMDAwMFow ITEfMB0GA1UEAwwWbG9vcGluZyBzZWxmLXNpZ25lZCBDQTBZMBMGByqGSM49AgEGlikely benign PEM-encoded test certificate embedded as a string literal.Reasoning
Raw-pass base64 flag on a PEM certificate string in a Rust test module. The header and body are a self-signed test certificate with a 'looping self-signed CA' label, which reads as a test fixture for path-building, not a payload.
-
-----BEGIN CERTIFICATE----- MIIBWzCCAQYCARgwDQYJKoZIhvcNAQEEBQAwODELMAkGA1UEBhMCQVUxDDAKBgNV BAgTA1FMRDEbMBkGA1UEAxMSU1NMZWF5L3JzYSB0ZXN0IENBMB4XDTk1MDYxOTIz MzMxMloXDTk1MDcxNzIzMzMxMlowOjELMAkGA1UEBhMCQVUxDDAKBgNVBAgTA1FMlikely benign PEM-encoded test certificate in a verification test file.Reasoning
Raw-pass base64 flag on a PEM certificate in a verification test. The content is a standard X.509 test certificate (the SSLeay test CA), with no execution or decoding logic around it.
-
info
warn→ info by reviewencoding-escape-soupsrc/rust/cryptography-x509/src/ec_constants.rs:12:35const P256_CURVE_B: & = b"\x5a\xc6\x35\xd8\xaa\x3a\x93\xe7\xb3\xeb\xbd\x55\x76\x98\x86\xbc\x65\x1d\x06\xb0\xcc\x53\xb0\xf6\x3b\xce\x3c\x3e\x27\xd2\x60\x4b"; const P256_SEED: BitString = newlikely benign P-256 curve parameter b encoded as a byte string literal.Reasoning
The byte array is the P-256 curve b coefficient, a published NIST/SECG constant in a cryptography library's ASN.1 constants module. Long \x escape sequences are how Rust code commonly writes binary test or parameter data, so the escape-soup signal reflects formatting, not concealment.
-
const P256_SEED: BitString = newlikely benign P-256 curve seed value as a BitString literal.Reasoning
This is the P-256 seed bitstring from the SEC 2 / FIPS 186 curve definition, used to build an ASN.1 BitString. It is a fixed public parameter in a crypto library, and the hex escapes are a normal way to express it.
-
info
warn→ info by reviewencoding-escape-soupsrc/rust/cryptography-x509/src/ec_constants.rs:18:45.unwrap; const P256_UNCOMPRESSED_BASE: & = b"\x04\x6b\x17\xd1\xf2\xe1\x2c\x42\x47\xf8\xbc\xe6\xe5\x63\xa4\x40\xf2\x77\x03\x7d\x81\x2d\xeb\x33\xa0\xf4\xa1\x39\x45\xd8\x98\xc2\x96\x4f\xe3\x42\xe2\xfe\x1a\x7f\x9b\x8e\xe7\xeb\x4a\x7c\x0f\x9e\x16\x2b\xce\x33\x57\x6b\x31\x5e\xce\xcb\xb6\x40\x68\x37\xbf\x51\xf5";likely benign Uncompressed P-256 base point encoding as a byte literal.Reasoning
A 65-byte buffer beginning with 0x04 is an uncompressed SEC1 EC point, here the P-256 generator. This is a public standard constant used for ECDSA and ASN.1 encoding, not a payload.
-
info
warn→ info by reviewencoding-escape-soupsrc/rust/cryptography-x509/src/ec_constants.rs:52:35const P384_CURVE_B: & = b"\xb3\x31\x2f\xa7\xe2\x3e\xe7\xe4\x98\x8e\x05\x6b\xe3\xf8\x2d\x19\x18\x1d\x9c\x6e\xfe\x81\x41\x12\x03\x14\x08\x8f\x50\x13\x87\x5a\xc6\x56\x39\x8d\x8a\x2e\xd1\x9d\x2a\x85\xc8\xed\xd3\xec\x2a\xef"; const P384_SEED: BitString = newlikely benign P-384 curve parameter b encoded as a byte string literal.Reasoning
The 48-byte value is the P-384 curve b coefficient, a published standard parameter in a cryptography library constants file. Escape notation is an ordinary way to write it.
-
const P384_SEED: BitString = newlikely benign P-384 curve seed value as a BitString literal.Reasoning
This is the P-384 seed from the standard curve definition, a fixed public value used to construct an ASN.1 BitString in the library.
-
info
warn→ info by reviewencoding-escape-soupsrc/rust/cryptography-x509/src/ec_constants.rs:58:45const P384_UNCOMPRESSED_BASE: & = b"\x04\xaa\x87\xca\x22\xbe\x8b\x05\x37\x8e\xb1\xc7\x1e\xf3\x20\xad\x74\x6e\x1d\x3b\x62\x8b\xa7\x9b\x98\x59\xf7\x41\xe0\x82\x54\x2a\x38\x55\x02\xf2\x5d\xbf\x55\x29\x6c\x3a\x54\x5e\x38\x72\x76\x0a\xb7\x36\x17\xde\x4a\x96\x26\x2c\x6f\x5d\x9e\x98\xbf\x92\x92\xdc\x29\xf8\xf4\x1d\xbdlikely benign Uncompressed P-384 base point encoding as a byte literal.Reasoning
A 97-byte buffer starting with 0x04 is the uncompressed P-384 generator point in SEC1 form. It is a public standard constant with no executable or hidden behavior.
-
info
warn→ info by reviewencoding-escape-soupsrc/rust/cryptography-x509/src/ec_constants.rs:92:35const P521_CURVE_B: & = b"\x00\x51\x95\x3e\xb9\x61\x8e\x1c\x9a\x1f\x92\x9a\x21\xa0\xb6\x85\x40\xee\xa2\xda\x72\x5b\x99\xb3\x15\xf3\xb8\xb4\x89\x91\x8e\xf1\x09\xe1\x56\x19\x39\x51\xec\x7e\x93\x7b\x16\x52\xc0\xbd\x3b\xb1\xbf\x07\x35\x73\xdf\x88\x3d\x2c\x34\xf1\xef\x45\x1f\xd4\x6b\x50\x3f\x00";likely benign P-521 curve parameter b encoded as a byte string literal.Reasoning
The 66-byte value is the P-521 curve b coefficient, a standard published parameter. The leading zero byte and length match the P-521 field encoding, consistent with legitimate crypto constants.
-
const P521_SEED: BitString = newlikely benign P-521 curve seed value as a BitString literal.Reasoning
This is the P-521 seed from the standard curve definition, a fixed public value used to build an ASN.1 BitString.
-
info
warn→ info by reviewencoding-escape-soupsrc/rust/cryptography-x509/src/ec_constants.rs:98:46const P521_UNCOMPRESSED_BASE: & = b"\x04\x00\xc6\x85\x8e\x06\xb7\x04\x04\xe9\xcd\x9e\x3e\xcb\x66\x23\x95\xb4\x42\x9c\x64\x81\x39\x05\x3f\xb5\x21\xf8\x28\xaf\x60\x6b\x4d\x3d\xba\xa1\x4b\x5e\x77\xef\xe7\x59\x28\xfe\x1d\xc1\x27\xa2\xff\xa8\xde\x33\x48\xb3\xc1\x85\x6a\x42\x9b\xf9\x7e\x7e\x31\xc2\xe5\xbd\x66\x01\x1likely benign Uncompressed P-521 base point encoding as a byte literal.Reasoning
A 133-byte buffer starting with 0x04 is the uncompressed P-521 generator point in SEC1 form, a public standard constant. Its length and prefix match that encoding.
-
info
warn→ info by reviewencoding-escape-soupsrc/rust/cryptography-x509/src/ec_constants.rs:99:65ER: BigUint = new.unwlikely benign Elliptic curve group order (secp256k1 n) as a BigUint literal.Reasoning
The bytes begin 01 ff ff ... fa 51 86 87 83 bf 2f 96 6b 7f cc 01 48 f7 09 a5 d0 3b b5 c9 b8 89 9c 47 ae bb 6f b7 1e 91 38 64 09, which is the secp256k1 group order n. A BigUint constant of this kind is standard in crypto libraries.
-
} returnlikely benign Test helper that execs dedented source text into a namespace.Reasoning
exec is run on textwrap.dedent of a source string inside a test helper that returns a namespace. This is a typical pattern for defining test schemas or generated classes. The source is presumably test-controlled, but the snippet does not show where src comes from, so some doubt remains.
-
----- ----- 226TnQPvuX3FGxU+// +likely benign PEM RSA private key used as a test fixture.Reasoning
A PEM RSA private key in a file named fixtures_rsa.py under the test tree. This is an expected cryptographic test fixture, not a hidden payload.
-
=likely benign DER-encoded DSA key bytes split across literals in a test.Reasoning
A concatenated bytes literal encoding DER-structured DSA key material, used as a test input to key parsing. The binary-looking shape is expected for ASN.1 test vectors.
-
b b b blikely benign OpenSSH DSA public key data in a test.Reasoning
Eight lines of base64 that form an OpenSSH ssh-dss public key in a test. This is standard serialization test data, with no decoding or execution around it.
-
----- ----- /////////// /////== ----- -----likely benign Small PEM EC private key in a test.Reasoning
A short PEM private key block in a test for EC key loading. The content is a standard test vector with no execution or network use.
-
= assert . == -
b b b )likely benign OpenSSH ECDSA public key data in a test.Reasoning
An OpenSSH ecdsa-sha2-nistp256 public key split across byte-string lines in a serialization test. This is expected test data.
-
=likely benign RSA ciphertext test vector as a bytes literal.Reasoning
A concatenated bytes literal with many \x escapes forming RSA ciphertext. This is a known-answer test vector, which is the expected shape for crypto tests.
-
b b b blikely benign OpenSSH RSA public key data in a test.Reasoning
An OpenSSH ssh-rsa public key split across lines in a serialization test. This is ordinary test data.
-
b b b )likely benign Continuation of the RSA public key test data.Reasoning
A continuation of the same OpenSSH RSA public key test data at line 2734. Same benign reading.
-
"""\ MIICdQIBADALBgkqhkiG9w0BAQEEggJhMIICXQIBAAKBgQC7JHoJfg6yNzLMOWet 8Z49a4KD0dCspMAYvo2YAMB7/wdEycocujbhJ2n/seONi+5XqTqqFkM5VBl8rmkk FPZk/7x0xmdsTPECSWnHK+HhoaNDFPR3j8jQhVo1laxiqcEhAHegi5cwtFosuJAvlikely benign Triple-quoted RSA private key body in a serialization test.Reasoning
A triple-quoted PEM-style RSA private key body inside a serialization test. The content matches the key material from the other test fixtures, so it is test data.
-
"""\ MIIBPAIBAAJBAKrbeqkuRk8VcRmWFmtP+LviMB3+6dizWW3DwaffznyHGAFwUJ/I Tv0XtbsCyl3QoyKGhrOAy3RvPK5M38iuXT0CAwEAAQJAZ3cnzaHXM/bxGaR5CR1R rD1qFBAVfoQFiOH9uPJgMaoAuoQEisPHVcZDKcOv4wEg6/TInAIXBnEigtqvRzuylikely benign Embedded RSA private key test fixture in a serialization test.Reasoning
Raw-pass base64 hit on a PEM-style RSA key literal inside a test module of a cryptography library's serialization tests. These are fixture key blobs used to exercise parsing, not secrets or payloads. The raw pass has a high false-positive rate for base64-looking key material.
-
----- ----- ++6dizWW3DwaffznyHGAFwUJ/ / /likely benign RSA private key PEM test vector in a serialization test.Reasoning
Same RSA PRIVATE KEY fixture body as the earlier hit at line 309, used as a test vector for loading serialized keys. Nothing in the snippet executes or transmits anything.
-
/ +/++ /+++likely benign Base64 key material used as a serialization test fixture.Reasoning
Base64 key body in a test file for key serialization. It is test data consumed by parsing assertions, consistent with a cryptography test suite.
-
/ +/++ /+++likely benign Duplicate base64 key fixture in the serialization tests.Reasoning
Repeats the same base64 key body as line 1045 in the same test module. This is a duplicated fixture for another test case, with no decoding or execution path.
-
----- ----- 8Z49a4KD0dCspMAYvo2YAMB7//+5XqTqqFkM5VBl8rmkk /7x0xmdsTPECSWnHK+likely benign PKCS#8 private key PEM test vector.Reasoning
PKCS#8 PRIVATE KEY PEM block in a test module. Test vectors of this form are standard for checking key loaders, and the snippet shows only a string literal.
-
----- ----- +++0XP0tO //1s// /++likely benign Encrypted private key PEM test vector.Reasoning
Encrypted PKCS#8 PEM block in a serialization test. It is a fixture for testing password-protected key loading, which is a legitimate test pattern.
-
b b b )likely benign ECDSA OpenSSH public key test fixture.Reasoning
Adjacent byte-string literals form an ecdsa-sha2-nistp256 OpenSSH public key with a root@cloud-server-01 comment. This is a parsing test vector in an SSH key test module, and the key is not an active credential in any executable path.
-
b b b )likely benign Duplicate ECDSA P-256 SSH public key fixture.Reasoning
Same ecdsa-sha2-nistp256 public key literal as line 991, duplicated for another SSH test case. It is data for key parsing assertions.
-
b b b blikely benign ECDSA P-384 OpenSSH public key test fixture.Reasoning
ecdsa-sha2-nistp384 public key split across byte-string literals in a test file. It is a standard fixture for checking SSH key encoding and decoding.
-
b b b )likely benign Continuation of the ECDSA P-384 SSH key fixture.Reasoning
Continuation of the same nistp384 public key fixture as line 1028, split across lines of a test literal. No executable behavior is present.
-
b b b blikely benign ECDSA P-521 OpenSSH public key test fixture.Reasoning
ecdsa-sha2-nistp521 public key literal in an SSH test module. It is a parsing vector like the other key fixtures in the same file.
-
b b b blikely benign A base64-encoded SSH public key fixture used in a parsing test.Reasoning
The blob is an OpenSSH public key test vector with a plausible comment, inside a cryptography library's SSH key parsing test file. The line-wrapped base64 is ordinary fixture data, and it is not decoded into anything executed.
-
b b b )likely benign Another fragment of the SSH public key test fixture.Reasoning
This is a shifted slice of the same SSH key fixture as the neighbouring finding, in a test file. It is a legitimate test vector and shows no execution or exfiltration behaviour.
-
b b b )likely benign An ECDSA SSH public key fixture in a key-parsing test.Reasoning
The ecdsa-sha2-nistp256 public key line with a root@cloud-server-01 comment is a standard SSH key test vector. Variants of the same key appear across the test file, which fits the negative and positive parsing cases of a crypto library.
-
b b b )likely benign A malformed ECDSA SSH public key fixture used for negative parsing tests.Reasoning
This is a minor variant of the ECDSA SSH key fixture, with a truncated base64 body, which is typical of a malformed-key negative test. It is test data and has no runtime effect.
-
b b b )likely benign A corrupted ECDSA SSH public key fixture for negative tests.Reasoning
Another altered ECDSA key fixture with a changed body, consistent with corrupted-key test cases in a cryptography test suite. It is passive data.
-
b b b )likely benign A mutated ECDSA SSH public key fixture in a parsing test.Reasoning
This ECDSA key fixture differs by a few characters, which fits deliberate test mutation. It is static test data with no decoding that leads to execution.
-
= =likely benign Decompresses a Wycheproof test-vector ciphertext inside a cryptography test.Reasoning
The file is a Wycheproof known-answer test. zlib.decompress is applied to a ciphertext hex value loaded from the official Wycheproof test-vector JSON. The result is compared against expected output in a test, so this is data decoding for verification, not a runtime dropper.
-
assert ==likely benign A base64 OCSP response fixture compared in a test assertion.Reasoning
This is a DER-encoded OCSP response base64-decoded in an equality assertion in a test. The data is a standard certificate-status fixture.
-
assert ==likely benign A repeated base64 OCSP response fixture in a test.Reasoning
This is the same OCSP response fixture as the finding at line 325, used in a second test. It is legitimate test data.
-
b b ) =likely benign A base64-encoded OCSP timestamp structure in a test fixture.Reasoning
The base64 decodes to a DER-encoded GeneralizedTime-style OCSP date structure inside an OCSP test fixture. It is encoded test data, not hidden code.
-
assert ==likely benign A list of base64 CT log IDs used as expected values in a test.Reasoning
The four lines are base64 SHA-256 Certificate Transparency log IDs in a list compared against expected values. This is standard test data for SCT parsing.
-
== b b blikely benign A DER-encoded X.509 extension byte literal used as expected test output.Reasoning
The bytes literal is a DER-encoded extension structure, containing an OID and a UTF-8 string 'my org', used as expected output in a certificate extension test. The binary shape is expected for ASN.1 test data, and the escapes are not executed.
-
assert ==likely benign A DER-encoded ASN.1 test vector in an X.509 extension test assertion.Reasoning
The bytes literal is a DER-encoded GeneralizedTime sequence (0x30 0x22 with 0x80/0x81 tags and ASCII digits 2012/2013 dates) asserted against serialized output in an X.509 extension test. Byte escapes are the normal way to write binary test vectors in a crypto library's test suite.
-
assert ==likely benign A recorded binary certificate-transparency extension fixture compared in a test.Reasoning
The literal is a long binary blob starting with 0x04 0x82 (an OCTET STRING of SCT-style data) compared against ext.public_bytes() in a test. This is a recorded certificate-transparency extension fixture in a cryptography test module, not executable or obfuscated payload.
-
assert ==likely benign A DER-encoded ECDSA signature test vector for a signed certificate timestamp.Reasoning
The bytes are a DER ECDSA signature (0x30 0x45 0x02 0x21 ...) asserted against sct.signature in a test. Hex-escaped binary test data is expected in cryptographic test vectors.
-
assert ==likely benign Hex-escaped rows of the same DER signature test vector, flagged by the raw pass.Reasoning
The raw pass flagged the same escape-run rows as the AST finding above. The content is a DER signature test vector in a test file, so the encoding-hex shape reflects ordinary binary test data rather than hidden code.
-
== b b blikely benign A binary certificate-transparency fixture compared against public_bytes() in a test.Reasoning
This is another binary SCT-style fixture (0x04 0x81 0xf4 header, embedded ECDSA signature bytes) compared to ext.public_bytes() in a test assertion. Such escaped binary vectors are standard in cryptography test suites.
-
assert ==likely benign A DER-encoded X.509 extension test vector containing embedded ASCII strings.Reasoning
The literal is a DER certificate-policy/qualified-certificate extension fragment with readable ASCII strings (country code, 'Elektronisches Gesundheitsberuferegister', 'gematik.de') mixed with tag bytes. It is a realistic X.509 test vector compared against public_bytes(), with no execution or decoding of hidden content.
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&