Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency aws-cdk-lib to v2.187.0 [SECURITY] - autoclosed #2160

Closed
wants to merge 1 commit into from
Closed

Update dependency aws-cdk-lib to v2.187.0 [SECURITY] - autoclosed #2160

wants to merge 1 commit into from

Conversation

pulumi-renovate[bot]
Copy link
Contributor

@pulumi-renovate pulumi-renovate bot commented Apr 1, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
aws-cdk-lib (source) devDependencies minor 2.181.0 -> 2.187.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

GHSA-qq4x-c6h6-rfxh

Summary

The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called "constructs" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates.

The CDK Cognito UserPool construct deploys an AWS cognito user pool. An Amazon Cognito user pool is a user directory for web and mobile app authentication and authorization. Customers can deploy a client under this user pool through construct ‘UserPoolClient’ or through helper method 'addClient'. A user pool client resource represents an Amazon Cognito user pool client which is a configuration within a user pool that interacts with one mobile or web application authenticating with Amazon Cognito.

When users of the 'cognito.UserPoolClient' construct generate a secret value for the application client in AWS CDK, they can then reference the generated secrets in their stack. The CDK had an issue where, when the custom resource performed an SDK API call to 'DescribeCognitoUserPoolClient' to retrieve the generated secret, the full response was logged in the associated lambda function's log group. Any user authenticated in the account where logs of the custom resource are accessible and who has read-only permission could view the secret written to those logs.

This issue does not affect customers who are generating the secret value outside of the CDK as the secret is not referenced or logged.

Impact

To leverage this issue, an actor has to be authenticated in the account where logs of the custom resource Custom::DescribeCognitoUserPoolClient are accessible and have read-only permission for lambda function logs.

Users can review access to their log group through AWS CloudTrail logs to detect any unexpected access to read the logs.

Impacted versions: >2.37.0 and <=2.187.0

Patches

The patches are included in the AWS CDK Library release v2.187.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. To fully address this issue, users should rotate the secret by generating a new secret stored in AWS Secrets Manager. References to the secret will use the new secret on update.

When new CDK applications using the latest version are initialized, they will use the new behavior with updated logging.

Existing applications must upgrade to the latest version, change the feature flag (@​aws-cdk/cognito:logUserPoolClientSecretValue) to false, redeploy the application to apply this fix and use the new implementation with updated logging behavior.

Workarounds

Users can override the implementation changing Logging to be Logging.withDataHidden(). For example define class CustomUserPoolClient extends UserPoolClient and  in the new class define get userPoolClientSecret() to use Logging.withDataHidden().

Example

export class CustomUserPoolClient extends UserPoolClient {

  private readonly customUserPool : UserPool;
  private readonly customuserPoolClientId : string;
  constructor(scope: Construct, id: string, props: UserPoolClientProps) {
    super(scope, id, props);

    this.customUserPool = new UserPool(this, 'pool', {
      removalPolicy: RemovalPolicy.DESTROY,
    });

    const client = this.customUserPool.addClient('client', { generateSecret: true });
  }

  // Override the userPoolClientSecret getter to always return the secret
  public get userPoolClientSecret(): SecretValue {
    // Create the Custom Resource that assists in resolving the User Pool Client secret
    const secretValue = SecretValue.resourceAttribute(new AwsCustomResource(
      this,
      'DescribeCognitoUserPoolClient',
      {
    resourceType: 'Custom::DescribeCognitoUserPoolClient',
    onUpdate: {
      region: cdk.Stack.of(this).region,
      service: 'CognitoIdentityServiceProvider',
      action: 'describeUserPoolClient',
      parameters: {
        UserPoolId: this.customUserPool.userPoolId,
        ClientId: this.customUserPool,
      },
      physicalResourceId: PhysicalResourceId.of(this.userPoolClientId),
      // Disable logging of sensitive data
      logging: Logging.withDataHidden(),
    },
    policy: AwsCustomResourcePolicy.fromSdkCalls({
      resources: [this.customUserPool.userPoolArn],
    }),
    installLatestAwsSdk: false,
      },
    ).getResponseField('UserPoolClient.ClientSecret'));
    
    return secretValue;
  }
}

References

If you have any questions or comments about this advisory please contact AWS/Amazon Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.187.0

Compare Source

Features
Bug Fixes

Alpha modules (2.187.0-alpha.0)

Features

v2.186.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • redshiftserverless: The CfnWorkgroup.attrWorkgroupMaxCapacity attribute has been removed.
  • quicksight: The CfnAnalysis.SheetTextBoxProperty.interactions, CfnDashboard.SheetTextBoxProperty.interactions, and CfnTemplate.SheetTextBoxProperty.interactions properties have been removed.
  • imagebuilder: The CfnDistributionConfiguration.DistributionProperty.ssmParameterConfigurations property has been removed.
Features
Bug Fixes

Alpha modules (2.186.0-alpha.0)

Features
Bug Fixes

v2.185.0

Compare Source

Features
Bug Fixes
Alpha modules (2.185.0-alpha.0)
⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • scheduler-targets-alpha: The class KinesisDataFirehosePutRecord has been renamed to FirehosePutRecord.
Bug Fixes

v2.184.1

Compare Source

Reverts
Alpha modules (2.184.1-alpha.0)

v2.184.0

Compare Source

Features
Bug Fixes
Alpha modules (2.184.0-alpha.0)
⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • glue-alpha: Updated casing of workflow.addconditionalTrigger to workflow.addConditionalTrigger.
Bug Fixes

v2.183.0

Compare Source

Features
Bug Fixes
Alpha modules (2.183.0-alpha.0)
⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • scheduler-targets-alpha: The InspectorStartAssessmentRun target's constructor now accepts IAssessmentTemplate instead of CfnAssessmentTemplate as its parameter type. To migrate existing code, use the AssessmentTemplate.fromCfnAssessmentTemplate() method to convert your CfnAssessmentTemplate instances to IAssessmentTemplate.
Features
  • kinesisanalytics-flink-alpha: backfill missing enums for kinesisanalytics-flink-alpha (#​33632) (b55199a)
  • kinesisfirehose-destinations-alpha: backfill missing enums for kinesisfirehose-destinations-alpha (#​33633) (6ed7a45)
Bug Fixes
  • scheduler-alpha: deprecate Group in favour of ScheduleGroup (#​33678) (4d8eae9)
  • scheduler-targets-alpha: update inspector target to use IAssessmentTemplate instead of CfnAssessmentTemplate (#​33682) (50ba3ef)

v2.182.0

Compare Source

Features
Bug Fixes
Alpha modules (2.182.0-alpha.0)
Features
Bug Fixes

v2.181.1

Compare Source

Alpha modules (2.181.1-alpha.0)
⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
  • cognito-identitypool-alpha: Any IdentityPool resources deployed in versions >=2.179.0 will now fail to deploy. You will need to delete the IdentityPoolRoleAttachment from your stack via the console before redeploying.
Bug Fixes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - "every weekday" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@pulumi-renovate pulumi-renovate bot added dependencies Pull requests that update a dependency file impact/no-changelog-required This issue doesn't require a CHANGELOG update labels Apr 1, 2025
@pulumi-renovate pulumi-renovate bot enabled auto-merge (squash) April 1, 2025 01:23
@pulumi-renovate pulumi-renovate bot changed the title Update dependency aws-cdk-lib to v2.187.0 [SECURITY] Update dependency aws-cdk-lib to v2.187.0 [SECURITY] - autoclosed Apr 10, 2025
@pulumi-renovate pulumi-renovate bot closed this Apr 10, 2025
auto-merge was automatically disabled April 10, 2025 10:42

Pull request was closed

@pulumi-renovate pulumi-renovate bot deleted the renovate/minor-2.187-security branch April 10, 2025 10:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pulumi-renovate-approve pulumi-renovate-approve[bot] pulumi-renovate-approve[bot] approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file impact/no-changelog-required This issue doesn't require a CHANGELOG update
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants