Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

corretto/corretto-8

              develop @ 3cb2ddb
            

430

Fixes

CVEs

CRITICAL

Peak severity

22.9%

Coverage

Highlights

Auth Bypass: 99 prior fixes. Scrutinize any change in this area.

Security: most-fixed (17 issues). Treat as high-risk during review.

258 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: 90 fixes target sandbox escapes, with Nashorn a major hotspot: package access checks, doPrivileged contexts, and reflection access are repeatedly bypassed via array notation, caller-sensitive methods, and classloader tricks.

Signature Verification Bypass: Multiple bypasses via duplicate/case-variant manifests, missing authenticated attributes, and weak algorithms (MD5, DSA<1024) not being rejected; fixes harden state machines and enforce algorithm constraints.

Weak Cryptographic Algorithm: Recurring theme of weak algorithms (3DES, DES, RC4, MD5, DSA<1024, EC<224) being disabled then re-enabled or inconsistently applied across platforms; fixes repeatedly tighten these lists and enforce them in AlgorithmChecker.