5cd5332397
This commit adds: - Database migrations for app_delta fingerprints and client certificates - Scripts for certificate generation and fingerprint backfilling - Comprehensive security audit reports and findings tracking - Implementation documentation for certificate authentication - Test utilities for certificate renewal and fingerprinting - GE-ENFORCE collector fix documentation Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
1.1 KiB
1.1 KiB
| 1 | ID | Severity | CWE | Title | File | Lines | Status | Priority | Assigned | Notes |
|---|---|---|---|---|---|---|---|---|---|---|
| 2 | f_agent_binj_1 | HIGH | CWE-345 | Agent Binary Injection | plugins/endpoints/api/agentupload.py | 127-131 | Open | P0 | Malicious binary deployment as SYSTEM - requires code signing | |
| 3 | f_t_auth_acct_enum_1_1 | HIGH | CWE-204 | Account Enumeration via Lockout | shopdb/core/api/auth.py | 102-107 | Open | P0 | Username leak via HTTP 403/401 difference - fix constant-time response | |
| 4 | f_jwt_timing_1 | HIGH | CWE-208 | Collector API Key Timing Attack | shopdb/core/api/collector.py | 135-137 | Open | P0 | Replace == with hmac.compare_digest() | |
| 5 | f_jwt_1_1 | MEDIUM | CWE-613 | Refresh Token Non-Rotation | shopdb/core/api/auth.py | 160-186 | Open | P1 | 30-day token reuse - implement rotation | |
| 6 | f_t_gf_rate_limit_bypass_upload_1_1 | MEDIUM | CWE-770 | Token Refresh Rate Limit Bypass | shopdb/core/api/auth.py | 160-186 | Open | P1 | Add rate limiting to /refresh endpoint | |
| 7 | f_gf_upload_dos_1_3 | MEDIUM | CWE-307 | File Upload DoS | shopdb/config.py | 145-151 | Open | P1 | Add rate limiting to upload endpoints | |
| 8 | f_gf_collector_rc_3_event_dedup | LOW | CWE-362 | Event Deduplication Race Condition | plugins/endpoints/plugin.py | 1259-1278 | Open | P2 | TOCTOU in collector - add SELECT FOR UPDATE |