Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/calcite

              main @ cc1dcc4
            

Fixes

CVEs

CRITICAL

Peak severity

88.9%

Coverage

Highlights

Dependency Vulnerability: 4 prior fixes. Scrutinize any change in this area.

gradle.properties: most-fixed (5 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure TLS Trust Manager: A trust-all X509TrustManager was removed, indicating a past MITM risk that could affect any TLS connection made by Calcite.

Improper Certificate Validation: The Avatica HTTP client lacked truststore validation, allowing connections to servers with invalid certificates; a custom SSLContext with truststore was added.

Dependency Vulnerability: Multiple log4j2 CVEs (CVE-2021-44228, CVE-2021-45105, CVE-2021-44832) required successive upgrades, showing a recurring risk from unpatched logging dependencies.