Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cockroachdb/errors
master @ 4fc17f8
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Denial of Service: 1 prior fix. Scrutinize any change in this area.
protobuf: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: The project's protobuf-compiled files were vulnerable to an infinite loop / out-of-bounds skip condition during deserialization. This was resolved by recompiling the protobuf definitions with an updated gogoproto compiler. Developers must ensure any new or recompiled protobuf schemas are generated using secure, updated compilers to prevent parser-level denial of service.
Information Disclosure: Sensitive system data, specifically file paths contained within standard library error types like os.LinkError, bypassed error redaction during formatting and were printed to logs. Future error formatting rules and redaction wrappers must explicitly check and sanitize the fields of underlying standard OS and file system errors.