aws / aws/amazon-chime-sdk-android

Request to Update OpenSSL and libvpx Versions in Android Chime SDK Due to Identified Security Vulnerabilities

Open
#639 2 comments 0 reactions 0 assignees View on GitHub
security
Dominant language
Kotlin
Stars
113
Forks
60
Avg merge
40m
Merged PRs (30d)
2

Description

**Describe the bug**
Our security team has identified two critical vulnerabilities in the current versions of OpenSSL and libvpx included in the Android Chime SDK:

libvpx (CVE-2023-44488):

Issue: VP9 in libvpx before version 1.13.1 mishandles widths, leading to a crash related to encoding.
Current Version Used (in SDK): 1.12.0
Recommended Version: 1.13.1 or higher

OpenSSL (CVE-2023-2650):

Issue: Processing some specially crafted ASN.1 object identifiers or data containing them may result in significantly slow performance.
Current Version Used (in SDK): 1.1.1s
Recommended Version: OpenSSL 3.1.1 or higher
Could you confirm the versions of these dependencies in the latest release of the Android Chime SDK? If the reported versions are still used, we request that you update them to mitigate the identified security risks.

These vulnerabilities impact the security and performance of our application, and an update would ensure compliance with modern security standards. Please let us know if there are any timelines for addressing this issue or if further information is required.

Contributor guide

Open the contributing guide

Research direction

Start by checking the dependency versions bundled in the latest Android Chime SDK release, focusing on OpenSSL and libvpx. Compare them with the reported vulnerable versions and recommended minimums; done means confirming the versions and updating the dependencies if they remain affected, with security validation for the SDK release.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.