cdk-cloudfront-auth icon indicating copy to clipboard operation
cdk-cloudfront-auth copied to clipboard
verified publisher icon henrist

chore(deps): update dependency aws-cdk-lib to v2.187.0 [security]

Open renovate[bot] opened this issue 2 years ago • 1 comments

This PR contains the following updates:

Package Change Age Confidence
aws-cdk-lib (source) 2.76.0 -> 2.187.0 age confidence
aws-cdk-lib (source) 2.87.0 -> 2.187.0 age confidence

GitHub Vulnerability Alerts

CVE-2023-35165

If you are using the eks.Cluster or eks.FargateCluster construct we need you to take action. Other users are not affected and can stop reading.

Impact

The AWS Cloud Development Kit (CDK) allows for the definition of Amazon Elastic Container Service for Kubernetes (EKS) clusters. eks.Cluster and eks.FargateCluster constructs create two roles that have an overly permissive trust policy.

The first, referred to as the CreationRole, is used by lambda handlers to create the cluster and deploy Kubernetes resources (e.g KubernetesManifest, HelmChart, ...) onto it. Users with CDK version higher or equal to 1.62.0 (including v2 users) will be affected.

The second, referred to as the default MastersRole, is provisioned only if the mastersRole property isn't provided and has permissions to execute kubectl commands on the cluster. Users with CDK version higher or equal to 1.57.0 (including v2 users) will be affected.

Both these roles use the account root principal in their trust policy, which allows any identity in the account with the appropriate sts:AssumeRole permissions to assume it. For example, this can happen if another role in your account has sts:AssumeRole permissions on Resource: "*".

CreationRole

Users with CDK version higher or equal to 1.62.0 (including v2 users). The role in question can be located in the IAM console. It will have the following name pattern:

*-ClusterCreationRole-*

MastersRole

Users with CDK version higher or equal to 1.57.0 (including v2 users) that are not specifying the mastersRole property. The role in question can be located in the IAM console. It will have the following name pattern:

*-MastersRole-*

Patches

The issue has been fixed in versions v1.202.0, v2.80.0. We recommend you upgrade to a fixed version as soon as possible. See Managing Dependencies in the CDK Developer Guide for instructions on how to do this.

The new versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. This introduces some breaking changes that might require you to perform code changes. Refer to https://github.com/aws/aws-cdk/issues/25674 for a detailed discussion of options.

Workarounds

CreationRole

There is no workaround available for CreationRole.

MastersRole

To avoid creating the default MastersRole, use the mastersRole property to explicitly provide a role. For example:

new eks.Cluster(this, 'Cluster', { 
  ... 
  mastersRole: iam.Role.fromRoleArn(this, 'Admin', 'arn:aws:iam::xxx:role/Admin') 
});

References

https://github.com/aws/aws-cdk/issues/25674

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

CVE-2025-23206

Impact

Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34.

However, the current tls.connect method will always set rejectUnauthorized: false which is a potential security concern. CDK should follow the best practice and set rejectUnauthorized: true. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag.

Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack.

As a best practice, CDK should still fix this issue under a feature flag to avoid regression.

packages/@​aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts
❯❱ problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification
Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS
verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized
to false bypasses verification against the list of trusted CAs, which also leads to insecure
transport.

Patches

The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22). Once upgraded, please make sure the feature flag '@​aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in cdk.context.json or cdk.json. More details on feature flag setting is here.

Workarounds

N/A

References

https://github.com/aws/aws-cdk/issues/32920

GHSA-qq4x-c6h6-rfxh

Summary

The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called "constructs" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates.

The CDK Cognito UserPool construct deploys an AWS cognito user pool. An Amazon Cognito user pool is a user directory for web and mobile app authentication and authorization. Customers can deploy a client under this user pool through construct ‘UserPoolClient’ or through helper method 'addClient'. A user pool client resource represents an Amazon Cognito user pool client which is a configuration within a user pool that interacts with one mobile or web application authenticating with Amazon Cognito.

When users of the 'cognito.UserPoolClient' construct generate a secret value for the application client in AWS CDK, they can then reference the generated secrets in their stack. The CDK had an issue where, when the custom resource performed an SDK API call to 'DescribeCognitoUserPoolClient' to retrieve the generated secret, the full response was logged in the associated lambda function's log group. Any user authenticated in the account where logs of the custom resource are accessible and who has read-only permission could view the secret written to those logs.

This issue does not affect customers who are generating the secret value outside of the CDK as the secret is not referenced or logged.

Impact

To leverage this issue, an actor has to be authenticated in the account where logs of the custom resource Custom::DescribeCognitoUserPoolClient are accessible and have read-only permission for lambda function logs.

Users can review access to their log group through AWS CloudTrail logs to detect any unexpected access to read the logs.

Impacted versions: >2.37.0 and <=2.187.0

Patches

The patches are included in the AWS CDK Library release v2.187.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. To fully address this issue, users should rotate the secret by generating a new secret stored in AWS Secrets Manager. References to the secret will use the new secret on update.

When new CDK applications using the latest version are initialized, they will use the new behavior with updated logging.

Existing applications must upgrade to the latest version, change the feature flag (@​aws-cdk/cognito:logUserPoolClientSecretValue) to false, redeploy the application to apply this fix and use the new implementation with updated logging behavior.

Workarounds

Users can override the implementation changing Logging to be Logging.withDataHidden(). For example define class CustomUserPoolClient extends UserPoolClient and  in the new class define get userPoolClientSecret() to use Logging.withDataHidden().

Example

export class CustomUserPoolClient extends UserPoolClient {

  private readonly customUserPool : UserPool;
  private readonly customuserPoolClientId : string;
  constructor(scope: Construct, id: string, props: UserPoolClientProps) {
    super(scope, id, props);

    this.customUserPool = new UserPool(this, 'pool', {
      removalPolicy: RemovalPolicy.DESTROY,
    });

    const client = this.customUserPool.addClient('client', { generateSecret: true });
  }

  // Override the userPoolClientSecret getter to always return the secret
  public get userPoolClientSecret(): SecretValue {
    // Create the Custom Resource that assists in resolving the User Pool Client secret
    const secretValue = SecretValue.resourceAttribute(new AwsCustomResource(
      this,
      'DescribeCognitoUserPoolClient',
      {
    resourceType: 'Custom::DescribeCognitoUserPoolClient',
    onUpdate: {
      region: cdk.Stack.of(this).region,
      service: 'CognitoIdentityServiceProvider',
      action: 'describeUserPoolClient',
      parameters: {
        UserPoolId: this.customUserPool.userPoolId,
        ClientId: this.customUserPool,
      },
      physicalResourceId: PhysicalResourceId.of(this.userPoolClientId),
      // Disable logging of sensitive data
      logging: Logging.withDataHidden(),
    },
    policy: AwsCustomResourcePolicy.fromSdkCalls({
      resources: [this.customUserPool.userPoolArn],
    }),
    installLatestAwsSdk: false,
      },
    ).getResponseField('UserPoolClient.ClientSecret'));
    
    return secretValue;
  }
}

References

If you have any questions or comments about this advisory please contact AWS/Amazon Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.187.0

Compare Source

Features
Bug Fixes

Alpha modules (2.187.0-alpha.0)

Features

v2.186.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • redshiftserverless: The CfnWorkgroup.attrWorkgroupMaxCapacity attribute has been removed.
  • quicksight: The CfnAnalysis.SheetTextBoxProperty.interactions, CfnDashboard.SheetTextBoxProperty.interactions, and CfnTemplate.SheetTextBoxProperty.interactions properties have been removed.
  • imagebuilder: The CfnDistributionConfiguration.DistributionProperty.ssmParameterConfigurations property has been removed.
Features
Bug Fixes

Alpha modules (2.186.0-alpha.0)

Features
Bug Fixes

v2.185.0

Compare Source

Features
Bug Fixes

Alpha modules (2.185.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • scheduler-targets-alpha: The class KinesisDataFirehosePutRecord has been renamed to FirehosePutRecord.
Bug Fixes

v2.184.1

Compare Source

Reverts

Alpha modules (2.184.1-alpha.0)

v2.184.0

Compare Source

Features
Bug Fixes

Alpha modules (2.184.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • glue-alpha: Updated casing of workflow.addconditionalTrigger to workflow.addConditionalTrigger.
Bug Fixes

v2.183.0

Compare Source

Features
Bug Fixes

Alpha modules (2.183.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • scheduler-targets-alpha: The InspectorStartAssessmentRun target's constructor now accepts IAssessmentTemplate instead of CfnAssessmentTemplate as its parameter type. To migrate existing code, use the AssessmentTemplate.fromCfnAssessmentTemplate() method to convert your CfnAssessmentTemplate instances to IAssessmentTemplate.
Features
  • kinesisanalytics-flink-alpha: backfill missing enums for kinesisanalytics-flink-alpha (#​33632) (b55199a)
  • kinesisfirehose-destinations-alpha: backfill missing enums for kinesisfirehose-destinations-alpha (#​33633) (6ed7a45)
Bug Fixes
  • scheduler-alpha: deprecate Group in favour of ScheduleGroup (#​33678) (4d8eae9)
  • scheduler-targets-alpha: update inspector target to use IAssessmentTemplate instead of CfnAssessmentTemplate (#​33682) (50ba3ef)

v2.182.0

Compare Source

Features
Bug Fixes

Alpha modules (2.182.0-alpha.0)

Features
Bug Fixes

v2.181.1

Compare Source

Alpha modules (2.181.1-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • cognito-identitypool-alpha: Any IdentityPool resources deployed in versions >=2.179.0 will now fail to deploy. You will need to delete the IdentityPoolRoleAttachment from your stack via the console before redeploying.
Bug Fixes

v2.181.0

Compare Source

Features
Bug Fixes

Alpha modules (2.181.0-alpha.0)

Features

v2.180.0

Compare Source

Features
Bug Fixes

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Oslo, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] avatar Jun 20 '23 09:06 renovate[bot]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

  • Branch has one or more failed status checks

renovate[bot] avatar Jun 20 '23 09:06 renovate[bot]