Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

itext/itext7

              develop @ 732d6c7
            

Fixes

CVEs

CRITICAL

Peak severity

25.0%

Coverage

Highlights

Certificate Validation Bypass: 5 prior fixes. Scrutinize any change in this area.

CRLValidator.java: most-fixed (3 issues). Treat as high-risk during review.

25 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Certificate Validation Bypass: Multiple fixes address accepting CRL/OCSP responses signed by the certificate being validated or by untrusted issuers, indicating a systemic weakness in chain-of-trust enforcement.

Signature Validation Bypass: Signature coverage checks and revision validation have been bypassed due to incorrect byte range calculations, indirect object handling, and missing order enforcement.

XXE: Four separate XML parsing components were vulnerable to external entity resolution, showing a lack of a centralized secure parser configuration.