Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

aws/aws-lambda-java-libs

              main @ 99e0349
            

Fixes

CVEs

CRITICAL

Peak severity

100.0%

Coverage

Highlights

Dependency Vulnerability: 1 prior fix. Scrutinize any change in this area.

LambdaRuntimeApiClientImpl.java: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: The log4j-core dependency was pinned to a version with an incomplete Log4Shell fix, allowing remote code execution via crafted log messages. This is the most severe historical issue and indicates a need for strict dependency version pinning and rapid patching of logging libraries.

SSRF: The Runtime API client used url.openConnection() without bypassing the customer-configured HTTP proxy, allowing internal API calls to be intercepted and potentially redirected, leading to SSRF or data leakage. The fix uses Proxy.NO_PROXY to keep internal traffic isolated.

Dependency Vulnerability: The bundled curl library was outdated (7.73.0) with known vulnerabilities. Bumping to 7.77.0 addresses those issues. This highlights the risk of shipping native dependencies without regular updates.