Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

rootzoll/raspiblitz

              dev @ eb7b2f3
            

Fixes

CVEs

HIGH

Peak severity

37.5%

Coverage

Highlights

Information Disclosure: 6 prior fixes. Scrutinize any change in this area.

home.admin/config.scripts/cl.hsmtool.sh: most-fixed (2 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: Two separate fixes address the same insecure storage of Core Lightning autounlock passwords in /root/ with weak permissions, indicating a recurring pattern of credential exposure.

Local Privilege Escalation / Symlink Attack: Six Lightning-related scripts used predictable temp file paths based on shell PID, enabling symlink attacks for arbitrary file write and local privilege escalation. The fix introduced mktemp in /dev/shm, but sibling scripts may still use old patterns.

Supply Chain / Signature Verification: A broken signature verification (wrong file extension) could have accepted tampered binaries, and similar issues in other install scripts (Tor, JoinMarket, BTCPayServer) show a systemic weakness in supply-chain integrity checks.