Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency aws-cdk-lib to v2.177.0 [security] #86

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update dependency aws-cdk-lib to v2.177.0 [security] #86

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jan 29, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
aws-cdk-lib (source) 2.152.0 -> 2.177.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-23206

Impact

Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34.

However, the current tls.connect method will always set rejectUnauthorized: false which is a potential security concern. CDK should follow the best practice and set rejectUnauthorized: true. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag.

Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack.

As a best practice, CDK should still fix this issue under a feature flag to avoid regression.

packages/@​aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts
❯❱ problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification
Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS
verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized
to false bypasses verification against the list of trusted CAs, which also leads to insecure
transport.

Patches

The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22).
Once upgraded, please make sure the feature flag '@​aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in cdk.context.json or cdk.json. More details on feature flag setting is here.

Workarounds

N/A

References

https://github.com/aws/aws-cdk/issues/32920

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.177.0

Compare Source

Features
Bug Fixes
Alpha modules (2.177.0-alpha.0)
⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • glue-alpha: Developers must refactor their existing Job
    instantiation method calls to choose the right job type and language,
    and use the new constants static values to define the associated Job
    configuration settings. See the RFC and/or new README for examples.
Description of how you validated changes

Increased unit test coverage to > 90%, consulted with Glue service team
on best practices and sane defaults, updated integration tests.

Features
Bug Fixes
  • custom-resource-handlers: do not allow unauthorized connection for iam OIDC connection (under feature flag) (#​32921) (3e4f377), closes #​32920
Code Refactoring
  • glue-alpha: Refactored glue-alpha L2 CDK construct RFC 0497 (#​32521) (1a18dc9)

v2.176.0

Compare Source

Features
Bug Fixes
Reverts

Alpha modules (2.176.0-alpha.0)

Features
Bug Fixes

v2.175.1

Compare Source

Bug Fixes
Alpha modules (2.175.1-alpha.0)

v2.175.0

Compare Source

Features
Bug Fixes
Alpha modules (2.175.0-alpha.0)
Features
Bug Fixes

v2.174.1

Compare Source

Features
Alpha modules (2.174.1-alpha.0)

v2.174.0

Compare Source

Features
Bug Fixes
Reverts

Alpha modules (2.174.0-alpha.0)

Features
Bug Fixes

v2.173.4

Compare Source

Bug Fixes
Alpha modules (2.173.4-alpha.0)

v2.173.3

Compare Source

Bug Fixes

Alpha modules (2.173.3-alpha.0)

v2.173.2

Compare Source

Bug Fixes
  • cli: allow credential plugins to return null for expiration (#​32554) (e59b1db)
  • cli: doesn't support plugins that return initially empty credentials (#​32552) (7ee9b90)
Alpha modules (2.173.2-alpha.0)

v2.173.1

Compare Source

Bug Fixes
  • cli: getting credentials via SSO fails when the region is set in the profile (#​32520) (01fec04)
Alpha modules (2.173.1-alpha.0)

v2.173.0

Compare Source

Features
Bug Fixes
Alpha modules (2.173.0-alpha.0)
Features

v2.172.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • apigateway: We will be removing deprecated APIGatewayV2 constructs from aws-apigateway module.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Features
Bug Fixes

Alpha modules (2.172.0-alpha.0)

Features

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from p5 as a code owner January 29, 2025 18:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@p5 p5 Awaiting requested review from p5 p5 is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants