Homepage

aws-cdk-lib@2.26.0

Version 2 of the AWS Cloud Development Kit library

  • latest version

    2.273.0

  • latest non vulnerable version

    2.273.0

  • first published

    5 years ago

  • latest version published

    5 days ago

  • licenses detected

  • View aws-cdk-lib package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the aws-cdk-lib package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Symlink Attack

    aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library

    Affected versions of this package are vulnerable to Symlink Attack in the asset bundling output handling, which accepts a symbolic link that the Docker build placed in the output directory even though no such link was supplied as bundling input. An attacker who controls the Dockerfile, or code running inside the bundling container, can place a symbolic link into the produced asset that points outside the supplied inputs. This requires asset bundling with a Docker file.

    How to fix Symlink Attack?

    Upgrade aws-cdk-lib to version 2.267.0 or higher.

    <2.267.0
    • M
    Incorrect Calculation

    aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library

    Affected versions of this package are vulnerable to Incorrect Calculation due to the incorrect mapping of the S3LoggingOptions.encrypted property to the CloudFormation S3LogsConfig.EncryptionDisabled field. An attacker can cause build logs to be stored unencrypted by explicitly setting the encrypted property to true, which unintentionally disables encryption.

    How to fix Incorrect Calculation?

    Upgrade aws-cdk-lib to version 2.253.0 or higher.

    <2.253.0
    • H
    Command Injection

    aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library

    Affected versions of this package are vulnerable to Command Injection via the OsCommand helper in the Docker bundling process. An attacker can execute arbitrary commands on the host running the toolchain by injecting shell metacharacters into dependency version strings in the package.json file. This is only exploitable if the attacker can control the content of a dependency version string that is processed during Docker-based bundling with nodeModules specified.

    How to fix Command Injection?

    Upgrade aws-cdk-lib to version 2.260.0 or higher.

    <2.260.0
    • H
    Command Injection

    aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library

    Affected versions of this package are vulnerable to Command Injection via the NodejsFunction() local bundling pipeline, when an attacker controls the value of one or more of the properties externalModules, define, loader, inject, or esbuildArgs. The attacker can inject shell metacharacters to execute arbitrary commands on the host running the CDK toolchain.

    Note: This is fixed in 2.245.0 for all platforms but Windows.

    How to fix Command Injection?

    Upgrade aws-cdk-lib to version 2.246.0 or higher.

    <2.246.0
    • M
    Incorrect Default Permissions

    aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library

    Affected versions of this package are vulnerable to Incorrect Default Permissions in the IAM trust policy. A user with sts:AssumeRole permissions can escalate privileges to those defined by the IAM trust policy, including performing unauthorized actions on CloudFormation, CodeCommit, Lambda, and ECS.

    Note: After upgrading to the patched version, the feature flag @aws-cdk/pipelines:reduceStageRoleTrustScope must be set to true, and applications redeployed.

    How to fix Incorrect Default Permissions?

    Upgrade aws-cdk-lib to version 2.184.0 or higher.

    <2.184.0
    • L
    Improper Verification of Cryptographic Signature

    aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library

    Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the tls.connect method setting rejectUnauthorized to false by default. An attacker can intercept and manipulate the data transmitted over the connection by exploiting the lack of proper TLS verification.ֿ

    Note

    1. The issuer URL is specified by CDK users when defining their CDK application. If they choose to connect to an unauthorized OIDC provider, CDK should not prevent this. Furthermore, the code block is executed within a Lambda environment, which helps mitigate the risk of MITM attacks.

    2. After upgrading to the fixed version, ensure the feature flag @aws-cdk/aws-iam:oidcRejectUnauthorizedConnections is set to true in cdk.context.json or cdk.json. More details on AWS CDK feature flags setting can be found here.

    How to fix Improper Verification of Cryptographic Signature?

    Upgrade aws-cdk-lib to version 2.177.0 or higher.

    <2.177.0
    • H
    Incorrect Privilege Assignment

    aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library

    Affected versions of this package are vulnerable to Incorrect Privilege Assignment such that eks.Cluster and eks.FargateCluster constructs create two roles that have an overly permissive trust policy. Both these roles use the account root principal in their trust policy, which allows any identity in the account with the appropriate sts:AssumeRole permissions to assume it.

    Note:

    Only eks.Cluster or eks.FargateCluster construct users are impacted.

    How to fix Incorrect Privilege Assignment?

    Upgrade aws-cdk-lib to version 2.80.0 or higher.

    >=2.0.0 <2.80.0
    Go back to all versions of this package