# Library flaws reported within your Android SDK

**URL:** <https://devforum.zoom.us/t/library-flaws-reported-within-your-android-sdk/63544>\
**Category:** Android\
**Created:** [February 1, 2022, 2:33pm UTC](https://devforum.zoom.us/t/library-flaws-reported-within-your-android-sdk/63544 "2022-02-01T14:33:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![nicolas.bonnet](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/nicolas.bonnet/32/19492_2.png) [@nicolas.bonnet](https://devforum.zoom.us/u/nicolas.bonnet)\
**Post date:** [February 1, 2022, 2:33pm UTC](https://devforum.zoom.us/t/library-flaws-reported-within-your-android-sdk/63544/1 "2022-02-01T14:33:25Z")

</div>

**Description**  
Our quality/security tool Veracode reported multiple flaws in the Zoom Android SDK. Could you look at the reported issue (I don’t have access to those file). Also, some might be false positive flaws.

**Which Android Meeting SDK version?**  
zoom-sdk-android-5.7.1.1268

**List. of the reported issue:**

Cryptographic Issues (Use of a Broken or Risky Cryptographic Algorithm)[Explanation](https://cwe.mitre.org/data/definitions/327.html)

- us\zoom\net\X509Util.java (line 380)
- us\zoom\androidlib\utils\ZmFileUtils.java (line 666)
- com\zipow\videobox\g\UpgradeMgr.java (line 560)

Use of Hard-coded Password: [Explanation](https://cwe.mitre.org/data/definitions/259.html)

- us\zoom\sdk\ZoomSDK.java (line 1)

Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) [Explanation](https://cwe.mitre.org/data/definitions/470.html)

- us\zoom\androidlib\app\ZMFileListActivity.java (line 220)

Best regards

---

<div class="post-metadata">

**Author:** ![jon.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jon.zoom/32/13495_2.png) [@jon.zoom](https://devforum.zoom.us/u/jon.zoom)\
**Post date:** [February 3, 2022, 12:33am UTC](https://devforum.zoom.us/t/library-flaws-reported-within-your-android-sdk/63544/2 "2022-02-03T00:33:51Z")

</div>

Hi @nicolas.bonnet, thanks for bringing this up.

We are reviewing this with our security team and will keep you updated as soon as we are able.

Thanks!

---

<div class="post-metadata">

**Author:** ![nicolas.bonnet](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/nicolas.bonnet/32/19492_2.png) [@nicolas.bonnet](https://devforum.zoom.us/u/nicolas.bonnet)\
**Post date:** [March 2, 2022, 1:38pm UTC](https://devforum.zoom.us/t/library-flaws-reported-within-your-android-sdk/63544/3 "2022-03-02T13:38:21Z")

</div>

Hi @jon.zoom  
Any news regarding the issues mentioned above?

Thanks

---

<div class="post-metadata">

**Author:** ![jon.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jon.zoom/32/13495_2.png) [@jon.zoom](https://devforum.zoom.us/u/jon.zoom)\
**Post date:** [March 2, 2022, 7:21pm UTC](https://devforum.zoom.us/t/library-flaws-reported-within-your-android-sdk/63544/4 "2022-03-02T19:21:05Z")

</div>

Hi @nicolas.bonnet,

I have not heard any updates from our security on this yet. I’ll follow up with them and keep you posted.

Thanks!

---

<div class="post-metadata">

**Author:** ![jon.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jon.zoom/32/13495_2.png) [@jon.zoom](https://devforum.zoom.us/u/jon.zoom)\
**Post date:** [March 3, 2022, 5:49pm UTC](https://devforum.zoom.us/t/library-flaws-reported-within-your-android-sdk/63544/5 "2022-03-03T17:49:14Z")

</div>

Hi @nicolas.bonnet,

Looking at our [Vulnerability Disclosure Policy](https://explore.zoom.us/docs/en-us/vulnerability-disclosure-policy.html), it seems that we ask that potential security issues or concerns be reported directly to our Security Team using our HackerOne form or by emailing them directly at [security@zoom.us](mailto:security@zoom.us).

Thanks for thinking of Zoom Security! Hope you get a bounty!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [April 3, 2022, 3:49am UTC](https://devforum.zoom.us/t/library-flaws-reported-within-your-android-sdk/63544/6 "2022-04-03T03:49:19Z")

</div>

Closed on April 3, 2022, 3:49am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.