Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mvantellingen/python-zeep
main @ 1b7072c
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Broken Cryptography: 1 prior fix. Scrutinize any change in this area.
src/zeep/loader.py: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Broken Cryptography: The AsyncTransport was ignoring critical security configurations including SSL verification ('verify_ssl') and proxy parameters during client initialization, leaving connections susceptible to Man-In-The-Middle (MITM) attacks. Developers must verify that transport initializations always pass explicit security contexts.
SSRF: Enabling security settings like 'forbid_external' was bypassed during transitive remote fetches via nested xsd:import, xsd:include, or wsdl:import directives. This allows remote hosts to trigger internal HTTP requests despite explicit blocking configurations.