Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

arthurdejong/python-stdnum

              master @ 5d4ad17
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Insecure TLS: 2 prior fixes. Scrutinize any change in this area.

stdnum/do/cedula.py: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure TLS: The Dominican Republic (DGII) online lookup helper failed to propagate the TLS verification parameter down to the underlying HTTP request mechanism, allowing certificate verification to be bypassed during validation.

Insecure TLS: The library's shared SOAP client caching mechanism in `get_soap_client` did not include the SSL verification status in its cache key, leading to dangerous cache-reuse scenarios where an unverified connection client could be returned to a context requiring strict verification.