Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

itext/itext-dotnet

              develop @ 1cfa5b5
            

Fixes

CVEs

HIGH

Peak severity

26.1%

Coverage

Highlights

Auth Bypass: 15 prior fixes. Scrutinize any change in this area.

itext.sign: most-fixed (7 issues). Treat as high-risk during review.

20 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Flaws in certificate chain validation, path length limits, and missing or spoofed revocation checks (CRL/OCSP) allow invalid or malicious certificates to be trusted during signature verification.

Signature Validation Bypass: Improper ByteRange checking and failure to detect appended indirect objects or comments allow attackers to forge documents while maintaining a seemingly valid signature.

XML External Entity (XXE): Insecurely configured XML parsers in core utility classes and form-processing components permit remote attackers to perform XXE injection, resulting in local file disclosure.