Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

razorpay/razorpay-java

              master @ 6b9875f
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Cryptographic Issues: 1 prior fix. Scrutinize any change in this area.

src/main/java/com/razorpay/Utils.java: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Issues: The use of deterministic, key-derived initialization vectors (IVs) with AES-GCM allows attackers to decrypt ciphertexts or forge messages if the same key and IV combination is reused. Generating a unique 12-byte random IV using a cryptographically secure random number generator (SecureRandom) for every single encryption call is vital.

Cryptography: Mock or test helper methods implementing AES-GCM encryption were discovered using static or deterministic nonces. If test utilities or mock encryption routines are copy-pasted into production pathways, they inherit the deterministic IV vulnerability, enabling cryptographic attacks.