Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
eclipse-ee4j/glassfish
main @ 4a14386
11
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
nucleus/security/core/src/main/java/com/sun/enterprise/security/SecurityContext.java: most-fixed (2 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Two distinct fixes address shared mutable state (sessionPrincipal and defaultSecurityContext) that could cause cross-request authentication confusion, indicating a systemic risk in per-request security context isolation.
Supply Chain / Man-in-the-Middle: Two fixes address HTTP downloads of build artifacts, indicating a recurring pattern of insecure dependency retrieval that could lead to code execution via MITM tampering.
Path Traversal: The fix for accessing WEB-INF/META-INF resources via path traversal suggests a need for robust request path normalization before restricted-resource checks, a common web container vulnerability.