Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

googleapis/google-cloud-python

              main @ f479800
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Data Corruption: 1 prior fix. Scrutinize any change in this area.

google.cloud.spanner_dbapi.partition_helper: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Deserialization: The use of pickle for parsing Spanner partition IDs allowed remote code execution if partition tokens were tampered with by an untrusted actor. This represents a critical trust boundary violation where structured database tokens were processed unsafely.

Deserialization: Similar to the DBAPI partition helper, the core Spanner client utilized pickle for deserializing partition objects. Failing to use safe formats like JSON exposed callers of the Spanner partitioning APIs to arbitrary code execution risks.

Insecure Temporary File: When packaging Cloud Function source code, the system generated temporary archive files outside restricted permissions scopes. Local attackers on shared infrastructure could read these temporary zip files, leaking sensitive source code or credentials.