Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

psi-im/psi

              master @ 9ec7f92
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

iris/xmpp-core/tlshandler.cpp: most-fixed (3 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address TLS hostname validation for XMPP connections, indicating a historically weak spot where certificate spoofing could bypass authentication.

Auth Bypass: Repeated fixes for X.509 SAN iteration show that handling multiple certificate entries of the same type was error-prone, leading to validation bypass.

Auth Bypass: Incorrect GnuPG output parsing could accept invalid signatures as valid, undermining PGP-based authentication.