Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

RIPE-NCC/whois

              master @ 31ecc3d
            

Fixes

CVEs

CRITICAL

Peak severity

47.4%

Coverage

Highlights

Auth Bypass: 45 prior fixes. Scrutinize any change in this area.

whois-query/src/main/java/net/ripe/db/whois/query/executor/VersionQueryExecutor.java: most-fixed (4 issues). Treat as high-risk during review.

56 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address credential handling and pending-state logic; a single missed assignment or incorrect pending count can allow unauthorized updates.

Auth Bypass: OAuth token validation and scope handling have been patched repeatedly; scope confusion or missing mandatory scope can lead to privilege escalation.

Auth Bypass: Numerous validators were missing RS-maintainer or override checks on attribute modifications (org, status, sponsoring-org, country, remarks).