Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

osgi/osgi

              main @ a9bc041
            

Fixes

CVEs

HIGH

Peak severity

62.2%

Coverage

Highlights

Auth Bypass: 80 prior fixes. Scrutinize any change in this area.

org.osgi.impl.service.dmt/src/org/osgi/impl/service/dmt/DmtSessionImpl.java: most-fixed (11 issues). Treat as high-risk during review.

38 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recursive ACL and node permission validation routinely bypassed root-level or node-specific checks due to commented-out validation blocks or lack of proper principal security context propagation during plugin session creation.

Auth Bypass: LDAP filter evaluation and signer certificate chain matching logic suffered from custom wildcard escaping and parsing bypasses, allowing unauthorized execution or management of OSGi applications.

Privilege Escalation: Improper AccessControlContext tracking in the Async Service reference implementation allowed execution of sensitive actions under overly permissive contexts without proper doPrivileged encapsulation.