aws / aws/amazon-chime-sdk-android
Request to Update OpenSSL and libvpx Versions in Android Chime SDK Due to Identified Security Vulnerabilities
- Dominant language
- Kotlin
- Stars
- 113
- Forks
- 60
- Avg merge
- 40m
- Merged PRs (30d)
- 2
Description
**Describe the bug**
Our security team has identified two critical vulnerabilities in the current versions of OpenSSL and libvpx included in the Android Chime SDK:
libvpx (CVE-2023-44488):
Issue: VP9 in libvpx before version 1.13.1 mishandles widths, leading to a crash related to encoding.
Current Version Used (in SDK): 1.12.0
Recommended Version: 1.13.1 or higher
OpenSSL (CVE-2023-2650):
Issue: Processing some specially crafted ASN.1 object identifiers or data containing them may result in significantly slow performance.
Current Version Used (in SDK): 1.1.1s
Recommended Version: OpenSSL 3.1.1 or higher
Could you confirm the versions of these dependencies in the latest release of the Android Chime SDK? If the reported versions are still used, we request that you update them to mitigate the identified security risks.
These vulnerabilities impact the security and performance of our application, and an update would ensure compliance with modern security standards. Please let us know if there are any timelines for addressing this issue or if further information is required.
Contributor guide
Research direction
Start by checking the dependency versions bundled in the latest Android Chime SDK release, focusing on OpenSSL and libvpx. Compare them with the reported vulnerable versions and recommended minimums; done means confirming the versions and updating the dependencies if they remain affected, with security validation for the SDK release.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100