Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mozilla-services/socorro

              main @ d51dbf0
            

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Information Disclosure: 8 prior fixes. Scrutinize any change in this area.

requirements/constraints.txt: most-fixed (4 issues). Treat as high-risk during review.

25 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple authorization bypasses were fixed across different components, indicating a systemic issue with missing permission checks on sensitive data access and administrative functions.

SQL Injection: Multiple SQL injection vulnerabilities were found in database query builders, both in Python and PHP, due to string concatenation of user-controlled parameters.

Information Disclosure: Sensitive crash data and PII were exposed through incorrect permission classifications, telemetry exports, Sentry event logging, and un-sanitized processed crash fields.