Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cedadev/ndg_httpsclient
master @ b090ad8
5
Fixes
0
CVEs
HIGH
Peak severity
20.0%
Coverage
Highlights
Auth Bypass: 4 prior fixes. Scrutinize any change in this area.
ndg/httpsclient/ssl_peer_verification.py: most-fixed (3 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Incompatibility with underlying pyOpenSSL updates can silently disable certificate verification if the verification callback is registered as a class instance with __call__ rather than wrapped in a standard callable function. This prevents the verification logic from being executed during the TLS handshake.
Auth Bypass: Type mismatches during Python 3 migrations (such as handling subjectAltName as a string instead of bytes) can cause TLS peer verification to fail to match or parse SAN extensions, resulting in validation failures or potential bypasses.
Auth Bypass: Dependency-conditional execution logic can cause verification bypasses if features like SubjectAltName validation are toggled or evaluated incorrectly when necessary library dependencies (e.g., pyasn1) are absent.