V2Ray has received a security audit from 7ASecurity

[xiaokangwang]

V2Ray's primary code base v2ray-core has recently received a code audit from 7ASecurity, funded by OTF.

https://www.opentech.fund/security-safety-audits/v2ray-security-audit/

OR

V2R-01-V2Ray-Audit-Public-RC1.1.pdf

This security audit concluded that V2Ray had no exploits or any other critical flaws that could lead to the compromise of the host system. The other medium or minor issues we received have either been fixed or are in the process of requesting them to be fixed by upstream projects.

We would like to thank 7ASecurity for their excellent work at reviewing the code base and providing valuable feedback, and OTF for funding this code review(We are not aware of how much it costs OTF to conduct this code review).

[PoneyClairDeLune]

"V2R-01-007 WP1/2: Possible V2Ray DoS via JA3 Fingerprints"

It should be rephrased as "Possible V2Ray fingerprinting vector via JA3 fingerprints" to remedy confusion regarding "DoS".

V2Ray is not a VPN btw

[xiaokangwang]

I do not control how they will phase the report, but I let them know there are some concerns from communities that would benefit from their response.

[dyhkwong]

That's great. It's a pity that they did not discover some notable known issues in the community, e.g. X-Forwarded-For spoofing #1037, DoS attack #2783, and SOCKS authentication bypass.

[xiaokangwang]

I have instructed them not to report known issues or provide summarized report as they are already known..

[xiaokangwang]

But I was surprised as well they didn't even mention these known issues, maybe just a line to the issue would make me more happy.