Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

igniterealtime/smack

              master @ 48b894d
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Broken Cryptography: 2 prior fixes. Scrutinize any change in this area.

(HttpFileUploadManager): most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Broken Cryptography: Custom SSLSocketFactory and HostnameVerifier configurations were not propagated to HttpsURLConnection instances during HTTP file uploads, exposing file transfer sessions to MITM certificate validation bypasses. Developers must ensure that security configurations on the main XMPP connection always flow down to sub-transports.

Broken Cryptography: User-configured custom X509TrustManager instances were omitted during SmackTlsContext initialization, rendering configured certificate trust policies ineffective. Central TLS context initialization routines must strictly enforce and apply all supplied security managers.

Broken Cryptography: Historically, Smack has suffered from severe validation bypasses including failing to verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allowed attackers to spoof trusted entities.