Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
newrelic/infrastructure-agent
master @ 965cb0c
7
Fixes
0
CVEs
MEDIUM
Peak severity
0.0%
Coverage
Highlights
Information Disclosure: 3 prior fixes. Scrutinize any change in this area.
internal/integrations/v4/executor: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Privilege Escalation: Incorrect sequencing of owner changes (chown/chmod) relative to assigning linux capabilities (setcap) can allow unprivileged processes or local attackers to exploit the agent binary during or immediately after installation. Always apply ownership modifications prior to granting elevated kernel capabilities.
Information Disclosure: Insecure inheritance of the full agent process environment can leak host credentials and sensitive environment variables to third-party integration child processes. The environment must be explicitly scrubbed, passing only a strict allowlist of environment variables.
Insecure Permissions: Failing to explicitly declare and restrict owner permissions on the agent binary during Debian post-installation (sysv) setup leaves the agent open to unauthorized local modification while running in a highly privileged system mode.