Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

docker/docker-py

              main @ ae5dfe9
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Improper Certificate Validation: 1 prior fix. Scrutinize any change in this area.

docker/api/build.py: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Improper Certificate Validation: The SSH transport implementation previously utilized Paramiko's 'WarningPolicy' for missing host keys, allowing connections to unverified hosts and exposing clients to active MitM attacks. Although patched to 'RejectPolicy', any custom transport wrappers or alternative SSH connection points must rigorously maintain strict host key validation.

Injection: Insufficent sanitization of the 'tag' parameter during the build phase allowed injection attacks. While validation was added using standard OCI reference format regex, any new endpoints handling image tagging, pulling, or pushing must implement identical strict regex controls.