Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

requests/toolbelt

              master @ bcd5f7b
            

Fixes

CVEs

MEDIUM

Peak severity

33.3%

Coverage

Highlights

Insecure TLS Configuration: 1 prior fix. Scrutinize any change in this area.

requests_toolbelt/adapters/appengine.py: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure TLS Configuration: Custom host-header SSL adapters failed to propagate the SNI server_hostname during connection pool instantiation, potentially leading to failed or spoofed handshakes when routing to multi-tenant servers. developers must ensure that connection pool arguments are explicitly synchronized with requested host headers.

Insecure Transport: Serialization routines (pickling) did not preserve the '_validate_certificate' state, meaning unpickled adapters would silently drop certificate verification controls. This represents a silent downgrade of transport security in environments relying on serialized state.

Insecure TLS Connection: When proxying traffic through SSLAdapter, the configured SSL/TLS protocol version was not propagated to the proxy manager. This allowed connection fallback or negotiation over older, insecure protocols during the proxy handshake phase.