Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
javaee/glassfish
master @ 371c9e1
10
Fixes
12
CVEs
CRITICAL
Peak severity
22.2%
Coverage
Highlights
Log Injection: 3 prior fixes. Scrutinize any change in this area.
appserver/web/web-core: most-fixed (3 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
XML External Entity (XXE): XML deployment descriptors and configurations parsed during application deployment were historically vulnerable to external DTD and schema loading, potentially exposing internal files or facilitating internal SSRF.
Weak PRNG: The use of predictable java.util.Random instead of SecureRandom in session managers and authentication systems compromised the uniqueness of session identifiers, enabling session hijacking.
HTTP Response Splitting: Lack of CRLF validation in redirection targets and response headers enabled attackers to inject arbitrary headers or split HTTP responses, leading to cache poisoning and session fixation.