5cd5332397
This commit adds: - Database migrations for app_delta fingerprints and client certificates - Scripts for certificate generation and fingerprint backfilling - Comprehensive security audit reports and findings tracking - Implementation documentation for certificate authentication - Test utilities for certificate renewal and fingerprinting - GE-ENFORCE collector fix documentation Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
9 lines
1.1 KiB
CSV
9 lines
1.1 KiB
CSV
ID,Severity,CWE,Title,File,Lines,Status,Priority,Assigned,Notes
|
|
f_agent_binj_1,HIGH,CWE-345,Agent Binary Injection,plugins/endpoints/api/agentupload.py,127-131,Open,P0,,Malicious binary deployment as SYSTEM - requires code signing
|
|
f_t_auth_acct_enum_1_1,HIGH,CWE-204,Account Enumeration via Lockout,shopdb/core/api/auth.py,102-107,Open,P0,,Username leak via HTTP 403/401 difference - fix constant-time response
|
|
f_jwt_timing_1,HIGH,CWE-208,Collector API Key Timing Attack,shopdb/core/api/collector.py,135-137,Open,P0,,Replace == with hmac.compare_digest()
|
|
f_jwt_1_1,MEDIUM,CWE-613,Refresh Token Non-Rotation,shopdb/core/api/auth.py,160-186,Open,P1,,30-day token reuse - implement rotation
|
|
f_t_gf_rate_limit_bypass_upload_1_1,MEDIUM,CWE-770,Token Refresh Rate Limit Bypass,shopdb/core/api/auth.py,160-186,Open,P1,,Add rate limiting to /refresh endpoint
|
|
f_gf_upload_dos_1_3,MEDIUM,CWE-307,File Upload DoS,shopdb/config.py,145-151,Open,P1,,Add rate limiting to upload endpoints
|
|
f_gf_collector_rc_3_event_dedup,LOW,CWE-362,Event Deduplication Race Condition,plugins/endpoints/plugin.py,1259-1278,Open,P2,,TOCTOU in collector - add SELECT FOR UPDATE
|