Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pylons/pyramid

              main @ 5b13e4a
            

Fixes

CVEs

HIGH

Peak severity

31.3%

Coverage

Highlights

Auth Bypass: 16 prior fixes. Scrutinize any change in this area.

pyramid/authentication.py: most-fixed (7 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: String-based permission matches on Python 3 allowed authorization bypasses when a checked permission was a substring of an ACL-defined permission. Developers must ensure permission identifiers are non-string iterables or strictly compared.

Path Traversal: URL segments were decoded from UTF-8 to Unicode *after* safety checks, allowing directory traversal with '..' sequences. Canonicalization and security checks must occur on fully decoded paths.

Deserialization of Untrusted Data: Using signed pickle-based serialization for sessions allows remote code execution if keys are compromised. The framework replaced PickleSerializer with JSONSerializer as the safe default.