Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
prestodb/presto
master @ 913a641
6
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Denial of Service: 3 prior fixes. Scrutinize any change in this area.
AccessControlManager: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Access control can be bypassed during the startup window if SystemAccessControl SPI methods on the initial sentinel are not explicitly overridden to reject requests while security plugins are loading. Additionally, legacy internal API access can bypass security controls as tracked in CVE-2020-15087.
Auth Bypass: Introducing new SQL operations, such as ALTER COLUMN SET DATA TYPE, without explicitly registering authorization and connector-level access checks leads to quiet authorization bypasses on schema modifications.
Denial of Service: Unhandled exceptions during Velox expression optimization (e.g., dispatch failures for UNKNOWN types) can lead to sidecar crashes, terminating the execution environment.