Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
aws/amazon-ecs-agent
master @ cfabccd
23
Fixes
0
CVEs
HIGH
Peak severity
82.4%
Coverage
Highlights
Dependency Vulnerability: 5 prior fixes. Scrutinize any change in this area.
ecs-init/exec/iptables/iptables.go: most-fixed (5 issues). Treat as high-risk during review.
16 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Network Isolation: Multiple fixes address off-host access to the introspection port and localhost services, indicating a persistent weakness in network filtering rules. The sink symbols (getBlockIntrospectionOffhostAccessInputChainArgs, getInputChainArgs) are shared across fixes, suggesting incomplete or evolving rule sets.
Command Injection: Command injection via the interface name environment variable was fixed by adding validation. This is a high-risk sink because it directly constructs shell commands, and the fix only addresses one input vector.
Capability Restriction Bypass: Fault-injection capability advertisement was first restricted for EXTERNAL launch type, then disabled entirely, and a separate fix added nsenter as a required tool. This indicates confusion about when and how the capability should be gated, with multiple bypass attempts.