Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pyca/service-identity
main @ 3c83540
4
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
service_identity.py: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Insecure Certificate Validation: Inadequate wildcard matching rules allowed unauthorized domains to match partial or sub-wildcards, undermining TLS security. Matches must be restricted strictly to entire leftmost path segments.
Auth Bypass: Improperly sanitized input characters in DNS_ID and URI_ID components allowed unexpected bypasses. Validation must rely on a strict alphanumeric and special character allowlist.
Auth Bypass: Deferring wildcard pattern validation until matching time allowed malformed patterns to exist. Validation must occur immediately during constructor instantiation.