Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

javaee/javamail

              master @ ae30c21
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

mail/src/main/java/com/sun/mail/imap/IMAPStore.java: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: SASL login failure could fall back to non-SASL methods, bypassing authentication. Fix added isAuthenticated() check after SASL login.

Auth Bypass: SASL authentication was considered successful without verifying server response code 235, allowing spoofed success.

Privilege Escalation: File access for configuration loading was not wrapped in doPrivileged, allowing unauthorized access to privileged resources.