Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

aws/aws-sdk-android

              main @ c6f70a7
            

Fixes

CVEs

HIGH

Peak severity

25.0%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

aws-android-sdk-core: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): The XML parser in the SDK core did not restrict external DTDs or entity resolution, potentially allowing attackers to read local files or perform server-side requests via manipulated XML payloads. Ensure all DocumentBuilderFactory instances explicitly disable external entities.

Auth Bypass: Retaining sensitive session information in-memory, such as the userId, after a user signs out can allow local session reuse or unauthorized state transitions. Implement rigorous state teardown inside sign-out routines.

Insecure Cryptography: Using the legacy and weak SHA1PRNG algorithm for SecureRandom initialization can reduce entropy, impacting the strength of authentication tokens. Use strong, platform-default SecureRandom instances instead.