Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

corretto/amazon-corretto-crypto-provider

              main @ 2f28348
            

Fixes

CVEs

HIGH

Peak severity

45.5%

Coverage

Highlights

Information Disclosure: 4 prior fixes. Scrutinize any change in this area.

src/com/amazon/corretto/crypto/provider/AesGcmSpi.java: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Issues: Re-initializing ciphers with differing IV properties without properly resetting or validating the underlying native context (such as EVP_CIPHER_CTX) can lead to silent nonce truncation or buffer over-reads. Incorrect JCE state handling can also cause severe validation failures like key/IV reuse bypasses.

Use After Free: Sharing native pointers between linked keys (e.g., public and private key pairs) can result in premature memory releases. When one key is destroyed, it may release the underlying native key handle, leading to a Use-After-Free condition when the remaining key is referenced.

Information Disclosure: Sensitive cryptographic material and plaintexts risk exposure in process memory if custom, compiler-optimizable zeroing routines are used instead of reliable platform APIs (like OPENSSL_cleanse or custom secure allocators). This risk spans both C++ native buffers and JVM-managed SecretKey storage.