Skip to content

chore(deps): update dependency aws-cdk-lib to v2.187.0 [security]#91

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-aws-cdk-lib-vulnerability
Open

chore(deps): update dependency aws-cdk-lib to v2.187.0 [security]#91
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-aws-cdk-lib-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jun 20, 2023 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
aws-cdk-lib (source) 2.76.0 → 2.187.0 age confidence
aws-cdk-lib (source) 2.87.0 → 2.187.0 age confidence

GitHub Vulnerability Alerts

CVE-2023-35165

If you are using the eks.Cluster or eks.FargateCluster construct we need you to take action. Other users are not affected and can stop reading.

Impact

The AWS Cloud Development Kit (CDK) allows for the definition of Amazon Elastic Container Service for Kubernetes (EKS) clusters. eks.Cluster and eks.FargateCluster constructs create two roles that have an overly permissive trust policy.

The first, referred to as the CreationRole, is used by lambda handlers to create the cluster and deploy Kubernetes resources (e.g KubernetesManifest, HelmChart, ...) onto it. Users with CDK version higher or equal to 1.62.0 (including v2 users) will be affected.

The second, referred to as the default MastersRole, is provisioned only if the mastersRole property isn't provided and has permissions to execute kubectl commands on the cluster. Users with CDK version higher or equal to 1.57.0 (including v2 users) will be affected.

Both these roles use the account root principal in their trust policy, which allows any identity in the account with the appropriate sts:AssumeRole permissions to assume it. For example, this can happen if another role in your account has sts:AssumeRole permissions on Resource: "*".

CreationRole

Users with CDK version higher or equal to 1.62.0 (including v2 users). The role in question can be located in the IAM console. It will have the following name pattern:

*-ClusterCreationRole-*

MastersRole

Users with CDK version higher or equal to 1.57.0 (including v2 users) that are not specifying the mastersRole property. The role in question can be located in the IAM console. It will have the following name pattern:

*-MastersRole-*

Patches

The issue has been fixed in versions v1.202.0, v2.80.0. We recommend you upgrade to a fixed version as soon as possible. See Managing Dependencies in the CDK Developer Guide for instructions on how to do this.

The new versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. This introduces some breaking changes that might require you to perform code changes. Refer to https://github.com/aws/aws-cdk/issues/25674 for a detailed discussion of options.

Workarounds

CreationRole

There is no workaround available for CreationRole.

MastersRole

To avoid creating the default MastersRole, use the mastersRole property to explicitly provide a role. For example:

new eks.Cluster(this, 'Cluster', { 
  ... 
  mastersRole: iam.Role.fromRoleArn(this, 'Admin', 'arn:aws:iam::xxx:role/Admin') 
});

References

https://github.com/aws/aws-cdk/issues/25674

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

CVE-2025-23206

Impact

Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34.

However, the current tls.connect method will always set rejectUnauthorized: false which is a potential security concern. CDK should follow the best practice and set rejectUnauthorized: true. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag.

Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack.

As a best practice, CDK should still fix this issue under a feature flag to avoid regression.

packages/@​aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts
❯❱ problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification
Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS
verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized
to false bypasses verification against the list of trusted CAs, which also leads to insecure
transport.

Patches

The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22).
Once upgraded, please make sure the feature flag '@​aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in cdk.context.json or cdk.json. More details on feature flag setting is here.

Workarounds

N/A

References

https://github.com/aws/aws-cdk/issues/32920

GHSA-qq4x-c6h6-rfxh

Summary

The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called "constructs" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates.

The CDK Cognito UserPool construct deploys an AWS cognito user pool. An Amazon Cognito user pool is a user directory for web and mobile app authentication and authorization. Customers can deploy a client under this user pool through construct ‘UserPoolClient’ or through helper method 'addClient'. A user pool client resource represents an Amazon Cognito user pool client which is a configuration within a user pool that interacts with one mobile or web application authenticating with Amazon Cognito.

When users of the 'cognito.UserPoolClient' construct generate a secret value for the application client in AWS CDK, they can then reference the generated secrets in their stack. The CDK had an issue where, when the custom resource performed an SDK API call to 'DescribeCognitoUserPoolClient' to retrieve the generated secret, the full response was logged in the associated lambda function's log group. Any user authenticated in the account where logs of the custom resource are accessible and who has read-only permission could view the secret written to those logs.

This issue does not affect customers who are generating the secret value outside of the CDK as the secret is not referenced or logged.

Impact

To leverage this issue, an actor has to be authenticated in the account where logs of the custom resource Custom::DescribeCognitoUserPoolClient are accessible and have read-only permission for lambda function logs.

Users can review access to their log group through AWS CloudTrail logs to detect any unexpected access to read the logs.

Impacted versions: >2.37.0 and <=2.187.0

Patches

The patches are included in the AWS CDK Library release v2.187.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. To fully address this issue, users should rotate the secret by generating a new secret stored in AWS Secrets Manager. References to the secret will use the new secret on update.

When new CDK applications using the latest version are initialized, they will use the new behavior with updated logging.

Existing applications must upgrade to the latest version, change the feature flag (@​aws-cdk/cognito:logUserPoolClientSecretValue) to false, redeploy the application to apply this fix and use the new implementation with updated logging behavior.

Workarounds

Users can override the implementation changing Logging to be Logging.withDataHidden(). For example define class CustomUserPoolClient extends UserPoolClient and  in the new class define get userPoolClientSecret() to use Logging.withDataHidden().

Example

export class CustomUserPoolClient extends UserPoolClient {

  private readonly customUserPool : UserPool;
  private readonly customuserPoolClientId : string;
  constructor(scope: Construct, id: string, props: UserPoolClientProps) {
    super(scope, id, props);

    this.customUserPool = new UserPool(this, 'pool', {
      removalPolicy: RemovalPolicy.DESTROY,
    });

    const client = this.customUserPool.addClient('client', { generateSecret: true });
  }

  // Override the userPoolClientSecret getter to always return the secret
  public get userPoolClientSecret(): SecretValue {
    // Create the Custom Resource that assists in resolving the User Pool Client secret
    const secretValue = SecretValue.resourceAttribute(new AwsCustomResource(
      this,
      'DescribeCognitoUserPoolClient',
      {
    resourceType: 'Custom::DescribeCognitoUserPoolClient',
    onUpdate: {
      region: cdk.Stack.of(this).region,
      service: 'CognitoIdentityServiceProvider',
      action: 'describeUserPoolClient',
      parameters: {
        UserPoolId: this.customUserPool.userPoolId,
        ClientId: this.customUserPool,
      },
      physicalResourceId: PhysicalResourceId.of(this.userPoolClientId),
      // Disable logging of sensitive data
      logging: Logging.withDataHidden(),
    },
    policy: AwsCustomResourcePolicy.fromSdkCalls({
      resources: [this.customUserPool.userPoolArn],
    }),
    installLatestAwsSdk: false,
      },
    ).getResponseField('UserPoolClient.ClientSecret'));
    
    return secretValue;
  }
}

References

If you have any questions or comments about this advisory please contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.187.0

Compare Source

Features
Bug Fixes

Alpha modules (2.187.0-alpha.0)

Features

v2.186.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • redshiftserverless: The CfnWorkgroup.attrWorkgroupMaxCapacity attribute has been removed.
  • quicksight: The CfnAnalysis.SheetTextBoxProperty.interactions, CfnDashboard.SheetTextBoxProperty.interactions, and CfnTemplate.SheetTextBoxProperty.interactions properties have been removed.
  • imagebuilder: The CfnDistributionConfiguration.DistributionProperty.ssmParameterConfigurations property has been removed.
Features
Bug Fixes

Alpha modules (2.186.0-alpha.0)

Features
Bug Fixes

v2.185.0

Compare Source

Features
Bug Fixes

Alpha modules (2.185.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • scheduler-targets-alpha: The class KinesisDataFirehosePutRecord has been renamed to FirehosePutRecord.
Bug Fixes

v2.184.1

Compare Source

Reverts

Alpha modules (2.184.1-alpha.0)

v2.184.0

Compare Source

Features
Bug Fixes

Alpha modules (2.184.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • glue-alpha: Updated casing of workflow.addconditionalTrigger to workflow.addConditionalTrigger.
Bug Fixes

v2.183.0

Compare Source

Features
Bug Fixes

Alpha modules (2.183.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • scheduler-targets-alpha: The InspectorStartAssessmentRun target's constructor now accepts IAssessmentTemplate instead of CfnAssessmentTemplate as its parameter type. To migrate existing code, use the AssessmentTemplate.fromCfnAssessmentTemplate() method to convert your CfnAssessmentTemplate instances to IAssessmentTemplate.
Features
  • kinesisanalytics-flink-alpha: backfill missing enums for kinesisanalytics-flink-alpha (#​33632) (b55199a)
  • kinesisfirehose-destinations-alpha: backfill missing enums for kinesisfirehose-destinations-alpha (#​33633) (6ed7a45)
Bug Fixes
  • scheduler-alpha: deprecate Group in favour of ScheduleGroup (#​33678) (4d8eae9)
  • scheduler-targets-alpha: update inspector target to use IAssessmentTemplate instead of CfnAssessmentTemplate (#​33682) (50ba3ef)

v2.182.0

Compare Source

Features
Bug Fixes

Alpha modules (2.182.0-alpha.0)

Features
Bug Fixes

v2.181.1

Compare Source

Alpha modules (2.181.1-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • cognito-identitypool-alpha: Any IdentityPool resources deployed in versions >=2.179.0 will now fail to deploy. You will need to delete the IdentityPoolRoleAttachment from your stack via the console before redeploying.
Bug Fixes

v2.181.0

Compare Source

Features
Bug Fixes

Alpha modules (2.181.0-alpha.0)

Features

v2.180.0

Compare Source

Features
Bug Fixes

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Oslo, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Contributor Author

renovate bot commented Jun 20, 2023

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

  • Branch has one or more failed status checks

@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 11 times, most recently from c3b7db6 to 8bda2d5 Compare June 27, 2023 04:46
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 16 times, most recently from 7c3ad0f to 88eb8e3 Compare July 4, 2023 09:05
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 2 times, most recently from 3d3af31 to 571a4a5 Compare July 6, 2023 04:52
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 7 times, most recently from c3e9657 to 039cea5 Compare August 13, 2025 09:48
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 4 times, most recently from f16862f to b83be3e Compare September 7, 2025 10:01
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 2 times, most recently from 2069877 to 07623d3 Compare September 7, 2025 16:36
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 07623d3 to 592a193 Compare September 25, 2025 19:03
@renovate renovate bot changed the title fix(deps): update dependency aws-cdk-lib to v2.187.0 [security] chore(deps): update dependency aws-cdk-lib to v2.187.0 [security] Sep 25, 2025
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 592a193 to 84e57ac Compare October 21, 2025 20:54
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 7 times, most recently from 9e1bcc9 to d602088 Compare November 24, 2025 21:23
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from d602088 to a1e5a63 Compare December 5, 2025 10:03
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from a1e5a63 to 857012d Compare December 31, 2025 17:28
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 857012d to a741619 Compare January 8, 2026 16:40
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from a741619 to a55d3e0 Compare January 19, 2026 15:39
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from a55d3e0 to 68d1471 Compare February 2, 2026 16:54
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 68d1471 to 42f30b4 Compare February 12, 2026 17:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants