Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

open-telemetry/opentelemetry-python

              main @ 3ed7c06
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

opentelemetry-api/trace/propagation/tracecontext.py: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Config Injection: YAML safe_load on raw text with env substitution allows structure injection and recursion-based DoS; fix moved substitution after parsing and added visited-node set.

Config Injection: Substituting env values with newlines into YAML text enables structure injection; fix quotes values to prevent YAML structure breakage.

Code Injection: Unvalidated instrumentor options passed to instrument() can lead to code injection via declarative config; fix validates options via dataclass schema.