Skip to content

chore(deps): update dependency aws-cdk-lib to v2.187.0 [security] #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update dependency aws-cdk-lib to v2.187.0 [security] #64

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jan 30, 2025 •
edited
Loading

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
aws-cdk-lib (source) 2.84.0 → 2.187.0 age confidence

GitHub Vulnerability Alerts

CVE-2025-23206

Impact

Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34.

However, the current tls.connect method will always set rejectUnauthorized: false which is a potential security concern. CDK should follow the best practice and set rejectUnauthorized: true. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag.

Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack.

As a best practice, CDK should still fix this issue under a feature flag to avoid regression.

packages/@​aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts
❯❱ problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification
Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS
verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized
to false bypasses verification against the list of trusted CAs, which also leads to insecure
transport.

Patches

The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22).
Once upgraded, please make sure the feature flag '@​aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in cdk.context.json or cdk.json. More details on feature flag setting is here.

Workarounds

N/A

References

https://github.com/aws/aws-cdk/issues/32920

GHSA-qq4x-c6h6-rfxh

Summary

The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called "constructs" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates.

The CDK Cognito UserPool construct deploys an AWS cognito user pool. An Amazon Cognito user pool is a user directory for web and mobile app authentication and authorization. Customers can deploy a client under this user pool through construct ‘UserPoolClient’ or through helper method 'addClient'. A user pool client resource represents an Amazon Cognito user pool client which is a configuration within a user pool that interacts with one mobile or web application authenticating with Amazon Cognito.

When users of the 'cognito.UserPoolClient' construct generate a secret value for the application client in AWS CDK, they can then reference the generated secrets in their stack. The CDK had an issue where, when the custom resource performed an SDK API call to 'DescribeCognitoUserPoolClient' to retrieve the generated secret, the full response was logged in the associated lambda function's log group. Any user authenticated in the account where logs of the custom resource are accessible and who has read-only permission could view the secret written to those logs.

This issue does not affect customers who are generating the secret value outside of the CDK as the secret is not referenced or logged.

Impact

To leverage this issue, an actor has to be authenticated in the account where logs of the custom resource Custom::DescribeCognitoUserPoolClient are accessible and have read-only permission for lambda function logs.

Users can review access to their log group through AWS CloudTrail logs to detect any unexpected access to read the logs.

Impacted versions: >2.37.0 and <=2.187.0

Patches

The patches are included in the AWS CDK Library release v2.187.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. To fully address this issue, users should rotate the secret by generating a new secret stored in AWS Secrets Manager. References to the secret will use the new secret on update.

When new CDK applications using the latest version are initialized, they will use the new behavior with updated logging.

Existing applications must upgrade to the latest version, change the feature flag (@​aws-cdk/cognito:logUserPoolClientSecretValue) to false, redeploy the application to apply this fix and use the new implementation with updated logging behavior.

Workarounds

Users can override the implementation changing Logging to be Logging.withDataHidden(). For example define class CustomUserPoolClient extends UserPoolClient and  in the new class define get userPoolClientSecret() to use Logging.withDataHidden().

Example

export class CustomUserPoolClient extends UserPoolClient {

  private readonly customUserPool : UserPool;
  private readonly customuserPoolClientId : string;
  constructor(scope: Construct, id: string, props: UserPoolClientProps) {
    super(scope, id, props);

    this.customUserPool = new UserPool(this, 'pool', {
      removalPolicy: RemovalPolicy.DESTROY,
    });

    const client = this.customUserPool.addClient('client', { generateSecret: true });
  }

  // Override the userPoolClientSecret getter to always return the secret
  public get userPoolClientSecret(): SecretValue {
    // Create the Custom Resource that assists in resolving the User Pool Client secret
    const secretValue = SecretValue.resourceAttribute(new AwsCustomResource(
      this,
      'DescribeCognitoUserPoolClient',
      {
    resourceType: 'Custom::DescribeCognitoUserPoolClient',
    onUpdate: {
      region: cdk.Stack.of(this).region,
      service: 'CognitoIdentityServiceProvider',
      action: 'describeUserPoolClient',
      parameters: {
        UserPoolId: this.customUserPool.userPoolId,
        ClientId: this.customUserPool,
      },
      physicalResourceId: PhysicalResourceId.of(this.userPoolClientId),
      // Disable logging of sensitive data
      logging: Logging.withDataHidden(),
    },
    policy: AwsCustomResourcePolicy.fromSdkCalls({
      resources: [this.customUserPool.userPoolArn],
    }),
    installLatestAwsSdk: false,
      },
    ).getResponseField('UserPoolClient.ClientSecret'));
    
    return secretValue;
  }
}

References

If you have any questions or comments about this advisory please contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.187.0

Compare Source

Features
Bug Fixes

Alpha modules (2.187.0-alpha.0)

Features

v2.186.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • redshiftserverless: The CfnWorkgroup.attrWorkgroupMaxCapacity attribute has been removed.
  • quicksight: The CfnAnalysis.SheetTextBoxProperty.interactions, CfnDashboard.SheetTextBoxProperty.interactions, and CfnTemplate.SheetTextBoxProperty.interactions properties have been removed.
  • imagebuilder: The CfnDistributionConfiguration.DistributionProperty.ssmParameterConfigurations property has been removed.
Features
Bug Fixes

Alpha modules (2.186.0-alpha.0)

Features
Bug Fixes

v2.185.0

Compare Source

Features
Bug Fixes

Alpha modules (2.185.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • scheduler-targets-alpha: The class KinesisDataFirehosePutRecord has been renamed to FirehosePutRecord.
Bug Fixes

v2.184.1

Compare Source

Reverts

Alpha modules (2.184.1-alpha.0)

v2.184.0

Compare Source

Features
Bug Fixes

Alpha modules (2.184.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • glue-alpha: Updated casing of workflow.addconditionalTrigger to workflow.addConditionalTrigger.
Bug Fixes

v2.183.0

Compare Source

Features
Bug Fixes

Alpha modules (2.183.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • scheduler-targets-alpha: The InspectorStartAssessmentRun target's constructor now accepts IAssessmentTemplate instead of CfnAssessmentTemplate as its parameter type. To migrate existing code, use the AssessmentTemplate.fromCfnAssessmentTemplate() method to convert your CfnAssessmentTemplate instances to IAssessmentTemplate.
Features
  • kinesisanalytics-flink-alpha: backfill missing enums for kinesisanalytics-flink-alpha (#​33632) (b55199a)
  • kinesisfirehose-destinations-alpha: backfill missing enums for kinesisfirehose-destinations-alpha (#​33633) (6ed7a45)
Bug Fixes
  • scheduler-alpha: deprecate Group in favour of ScheduleGroup (#​33678) (4d8eae9)
  • scheduler-targets-alpha: update inspector target to use IAssessmentTemplate instead of CfnAssessmentTemplate (#​33682) (50ba3ef)

v2.182.0

Compare Source

Features
Bug Fixes

Alpha modules (2.182.0-alpha.0)

Features
Bug Fixes

v2.181.1

Compare Source

Alpha modules (2.181.1-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • cognito-identitypool-alpha: Any IdentityPool resources deployed in versions >=2.179.0 will now fail to deploy. You will need to delete the IdentityPoolRoleAttachment from your stack via the console before redeploying.
Bug Fixes

v2.181.0

Compare Source

Features
Bug Fixes

Alpha modules (2.181.0-alpha.0)

Features

v2.180.0

Compare Source

Features
Bug Fixes

Alpha modules (2.180.0-alpha.0)

Features

v2.179.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • eks: kubectlLayer property is now required in EKS Cluster and FargateCluster constructs. The default value for kubectlLayer is outdated and hence being removed. You can specify your own kubectlLayer version based on your Kubernetes version.
Features

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Oslo, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Contributor Author

renovate bot commented Jan 30, 2025

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

  • Branch has one or more failed status checks

@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 9cf029d to 8130f23 Compare February 9, 2025 13:45
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 8130f23 to 92c20ae Compare March 3, 2025 12:54
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 92c20ae to 06df20a Compare March 11, 2025 11:03
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 06df20a to dd39a2c Compare March 24, 2025 16:03
@renovate renovate bot changed the title chore(deps): update dependency aws-cdk-lib to v2.177.0 [security] chore(deps): update dependency aws-cdk-lib to v2.184.0 [security] Mar 24, 2025
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from dd39a2c to 866b8d9 Compare March 24, 2025 22:06
@renovate renovate bot changed the title chore(deps): update dependency aws-cdk-lib to v2.184.0 [security] chore(deps): update dependency aws-cdk-lib to v2.184.0 [security] - autoclosed Mar 31, 2025
@renovate renovate bot closed this Mar 31, 2025
@renovate renovate bot deleted the renovate/npm-aws-cdk-lib-vulnerability branch March 31, 2025 23:25
@renovate renovate bot changed the title chore(deps): update dependency aws-cdk-lib to v2.184.0 [security] - autoclosed chore(deps): update dependency aws-cdk-lib to v2.184.0 [security] Apr 1, 2025
@renovate renovate bot reopened this Apr 1, 2025
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 866b8d9 to 7a8c1e2 Compare April 1, 2025 03:23
@renovate renovate bot changed the title chore(deps): update dependency aws-cdk-lib to v2.184.0 [security] chore(deps): update dependency aws-cdk-lib to v2.187.0 [security] Apr 1, 2025
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 2 times, most recently from 55b5840 to 1dd5e21 Compare April 10, 2025 02:54
@renovate renovate bot changed the title chore(deps): update dependency aws-cdk-lib to v2.187.0 [security] chore(deps): update dependency aws-cdk-lib to v2.189.0 [security] Apr 10, 2025
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 1dd5e21 to 94274aa Compare April 10, 2025 06:58
@renovate renovate bot changed the title chore(deps): update dependency aws-cdk-lib to v2.189.0 [security] chore(deps): update dependency aws-cdk-lib to v2.187.0 [security] Apr 10, 2025
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 94274aa to af71463 Compare April 24, 2025 06:29
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from af71463 to c663c59 Compare May 19, 2025 20:50
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 2 times, most recently from 18734f1 to e6654a3 Compare June 4, 2025 06:37
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from e6654a3 to b557723 Compare June 22, 2025 14:07
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from b557723 to 182ffbb Compare July 2, 2025 15:08
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 5 times, most recently from 68e8dff to 3bc9ac9 Compare July 19, 2025 12:38
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 3bc9ac9 to af75372 Compare July 19, 2025 17:14
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 8 times, most recently from 4555046 to ab5f8ff Compare August 13, 2025 03:51
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 4 times, most recently from 33c546f to a9eb715 Compare September 7, 2025 05:03
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from a9eb715 to cd010dc Compare September 25, 2025 21:12
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 3 times, most recently from 7491fe5 to 5e5e867 Compare October 28, 2025 10:52
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 3 times, most recently from 62825aa to bf17d76 Compare October 29, 2025 03:52
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 4 times, most recently from 5756b7d to 089a7dd Compare November 24, 2025 09:42
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 089a7dd to 3869199 Compare December 5, 2025 09:13
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 3869199 to 3087e2f Compare December 31, 2025 16:53
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 3087e2f to 15850c1 Compare January 8, 2026 18:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant