Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

scylladb/java-driver

              scylla-4.x @ 7e040eb
            

Fixes

CVEs

HIGH

Peak severity

83.3%

Coverage

Highlights

Dependency Vulnerability: 2 prior fixes. Scrutinize any change in this area.

pom.xml: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Supply Chain Attack: Third-party actions were unpinned, allowing tampering or substitution of CI steps; pinning to immutable SHAs mitigates this.

Man-in-the-Middle: SSL hostname validation was disabled by default, allowing MITM attacks via certificate hostname mismatch; flipped default to true.

SSL/TLS Hostname Verification Bypass: SNI SSL engine lacked endpoint identification algorithm, bypassing hostname verification; fixed by setting HTTPS algorithm and advisory peer host.