Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency aws-cdk-lib [security] #25

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore(deps): update dependency aws-cdk-lib [security] #25

wants to merge 2 commits into from

Conversation

cu-infra-svc-git
Copy link
Collaborator

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
aws-cdk-lib (source) ^2.95.1 -> ^2.178.1 age adoption passing confidence
aws-cdk-lib (source) 2.95.1 -> 2.177.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-23206

Impact

Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34.

However, the current tls.connect method will always set rejectUnauthorized: false which is a potential security concern. CDK should follow the best practice and set rejectUnauthorized: true. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag.

Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack.

As a best practice, CDK should still fix this issue under a feature flag to avoid regression.

packages/@​aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts
❯❱ problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification
Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS
verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized
to false bypasses verification against the list of trusted CAs, which also leads to insecure
transport.

Patches

The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22).
Once upgraded, please make sure the feature flag '@​aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in cdk.context.json or cdk.json. More details on feature flag setting is here.

Workarounds

N/A

References

https://github.com/aws/aws-cdk/issues/32920

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.178.1

Compare Source

Bug Fixes
  • cli: sdk logging is always present even when not turned on (#​33324) (29a9a6d), closes #​33320
  • custom-resource: provider framework lambda missing GetFunction permission (#​33315)

Alpha modules (2.178.1-alpha.0)

v2.178.0

Compare Source

Features
Bug Fixes

Alpha modules (2.178.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • ec2-alpha: operatingRegion property under IPAM class is now renamed to operatingRegions.
Features
Bug Fixes

v2.177.0

Compare Source

Features
Bug Fixes

Alpha modules (2.177.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • glue-alpha: Developers must refactor their existing Job
    instantiation method calls to choose the right job type and language,
    and use the new constants static values to define the associated Job
    configuration settings. See the RFC and/or new README for examples.
Description of how you validated changes

Increased unit test coverage to > 90%, consulted with Glue service team
on best practices and sane defaults, updated integration tests.

Features
Bug Fixes
  • custom-resource-handlers: do not allow unauthorized connection for iam OIDC connection (under feature flag) (#​32921) (3e4f377), closes #​32920
Code Refactoring
  • glue-alpha: Refactored glue-alpha L2 CDK construct RFC 0497 (#​32521) (1a18dc9)

v2.176.0

Compare Source

Features
Bug Fixes
Reverts

Alpha modules (2.176.0-alpha.0)

Features
Bug Fixes

v2.175.1

Compare Source

Bug Fixes

Alpha modules (2.175.1-alpha.0)

v2.175.0

Compare Source

Features
Bug Fixes

Alpha modules (2.175.0-alpha.0)

Features
Bug Fixes

v2.174.1

Compare Source

Features

Alpha modules (2.174.1-alpha.0)

v2.174.0

Compare Source

Features
Bug Fixes
Reverts

Alpha modules (2.174.0-alpha.0)

Features
Bug Fixes

v2.173.4

Compare Source

Bug Fixes

Alpha modules (2.173.4-alpha.0)

v2.173.3

Compare Source

Bug Fixes

Alpha modules (2.173.3-alpha.0)

v2.173.2

Compare Source

Bug Fixes
  • cli: allow credential plugins to return null for expiration (#​32554) (e59b1db)
  • cli: doesn't support plugins that return initially empty credentials (#​32552) (7ee9b90)

Alpha modules (2.173.2-alpha.0)

v2.173.1

Compare Source

Bug Fixes
  • cli: getting credentials via SSO fails when the region is set in the profile (#​32520) (01fec04)

Alpha modules (2.173.1-alpha.0)

v2.173.0

Compare Source

Features
Bug Fixes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@codecov Codecov
Copy link

codecov bot commented Feb 12, 2025 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (9e4afd5) to head (a3a9bf3).

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff            @@
##              main       #25   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            2         2           
  Lines          132       132           
  Branches        10         7    -3     
=========================================
  Hits           132       132

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9e4afd5...a3a9bf3. Read the comment docs.

chore: self mutation
a3a9bf3 
Signed-off-by: github-actions <[email protected]>
@cu-infra-svc-git
Copy link
Collaborator Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
renovate
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@cu-infra-svc-git