Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

googlecloudplatform/gcloud-python

              main @ ad02121
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Insecure Deserialization: 2 prior fixes. Scrutinize any change in this area.

google-cloud-spanner: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Deserialization: The use of pickle.loads to deserialize partition IDs allowed for arbitrary remote code execution. Replacing this with JSON deserialization was necessary to prevent untrusted payloads from executing system-level commands.

Insecure Deserialization: Parallel to the DB-API issue, the core google-cloud-spanner package also utilized insecure pickle-based partition deserialization, exposing users to remote code execution risks prior to migrating to JSON.

Insecure Temporary File: Creating temporary zip archives of user-submitted cloud functions in world-readable system temp directories, combined with a lack of proper cleanup, allowed local attackers to read sensitive user code.