Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

belaban/jgroups

              master @ bd654e3
            

Fixes

CVEs

CRITICAL

Peak severity

19.4%

Coverage

Highlights

Auth Bypass: 26 prior fixes. Scrutinize any change in this area.

src/org/jgroups/protocols/AUTH.java: most-fixed (14 issues). Treat as high-risk during review.

23 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The AUTH protocol layer has repeatedly failed to intercept and authenticate critical cluster control messages, notably bypassing validation when messages completely lacked an AUTH header, or when processing specific message subtypes like JOIN_REQ_WITH_STATE_TRANSFER and MERGE_REQ. This directly allows unauthorized nodes to join or merge into secure clusters.

Auth Bypass: IP-based membership authorization was vulnerable to complete bypass because the validation logic relied on the spoofable logical source address contained within incoming messages, rather than resolving and validating the sender's actual physical network address.

Auth Bypass: Improper initialization ordering and hashing logic resulted in plaintext passwords being compared against cryptographic hashes, or hashes being computed before configuration parameters like 'hash_type' were set, creating a direct path to authentication bypass.