Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

googlecloudplatform/google-cloud-python

              main @ ad02121
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Insecure Deserialization: 2 prior fixes. Scrutinize any change in this area.

google-cloud-spanner: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Deserialization: The use of pickle.loads during the deserialization of partition IDs allowed remote attackers to execute arbitrary code. Deserialization of structured state in the DB-API must exclusively use secure formats like JSON.

Insecure Deserialization: Similar to the DB-API vulnerability, the core Spanner client used insecure pickle deserialization for partition objects, which poses a severe remote code execution risk if partition tokens are manipulated.

Insecure Temporary File: Creating zip archives of user code in public shared temporary directories without restrictive permissions can lead to local information disclosure or local privilege escalation.