Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
exoscale/egoscale
master @ 6f88335
2
Fixes
0
CVEs
HIGH
Peak severity
100.0%
Coverage
Highlights
Request Forgery: 1 prior fix. Scrutinize any change in this area.
internal/v2/security.go: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Signature Bypass: Using the unescaped URL path in HMAC signature generation allows an attacker to alter the path encoding and produce a valid signature for a different request, bypassing authentication.
Request Forgery: Consuming the request body during signature generation without restoring it leaves the body empty or altered for the actual send, enabling request forgery or denial of service.