Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/calcite-avatica

              main @ 9d3401b
            

Fixes

CVEs

CRITICAL

Peak severity

100.0%

Coverage

Highlights

Denial of Service: 1 prior fix. Scrutinize any change in this area.

gradle.properties: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Log4Shell (RCE via JNDI): The most severe historical issue: Log4j2 2.15.0 allowed JNDI-based remote code execution via crafted log messages; the fix disabled JNDI lookups by upgrading to 2.16.0. Any future log4j2 version regression or misconfiguration re-exposes this critical path.

Remote Code Execution: Even after the Log4Shell fix, Log4j2 2.17.0 remained vulnerable to CVE-2021-44832, an RCE via JDBC Appender. The bump to 2.17.1 closed this gap, showing that a single dependency required multiple sequential patches; vigilance on log4j2 patch level is mandatory.

Denial of Service: Log4j2 2.16.0 was vulnerable to CVE-2021-45105, an infinite recursion DoS via crafted log patterns. The upgrade to 2.17.0 fixed this, reinforcing that the logging library is a repeated source of high-impact vulnerabilities.