CVE-2023-35165: Incorrect Authorization

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

Overly Permissive Trust Policies

aws-cdk is vulnerable to Overly Permissive Trust Policies. The vulnerability exists because the library's CreationRole and the default MastersRole use the account root principal in their trust policy, which allows eks.Cluster and eks.FargateCluster construct clusters to create two roles that have...

GHSA-RX28-R23P-2QC3 AWS CDK EKS overly permissive trust policies

If you are using the eks.Cluster or eks.FargateCluster construct we need you to take action. Other users are not affected and can stop reading. Impact The AWS Cloud Development Kit CDK allows for the definition of Amazon Elastic Container Service for Kubernetes EKS clusters. eks.Cluster and...

@104corp/cdk-aws-codedeploy-on-premises (>=1.0.0, <=1.0.2), @aws-cdk/aws-stepfunctions-tasks (>=1.91.0, <=1.201.0) +30 more potentially affected by CVE-2023-35165 via @aws-cdk/aws-eks (>=1.57.0, <=1.201.0)

@aws-cdk/aws-eks NPM version =1.57.0, =1.0.0, =1.91.0, =1.57.0, =0.12.1, =1.115.0, =1.91.0, =1.91.0, =1.115.0, =0.0.1-beta.1, =0.0.1, =25.1.0, =0.2.0, =0.1.0, =0.3.2 and more Source cves: CVE-2023-35165 Source advisory: OSV:GHSA-RX28-R23P-2QC3...

@alliander-opensource/aws-jwt-sts (0.2.6), @almaclaine/cdk (>=0.0.3, <=0.0.19) +199 more potentially affected by CVE-2023-35165 via aws-cdk-lib (>=2.0.0, <=2.79.1)

aws-cdk-lib NPM version =2.0.0, =0.0.3, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.0.0-ampgenconfig.0, =5.0.0-beta.0, =3.0.0-ampgenconfig.0, =3.5.0-beta.0, =5.0.0-beta.0, =2.24.0-beta.0, =5.0.0-beta.0, =4.0.0-cdkv2.0, =5.3.3 and...

AWS CDK EKS overly permissive trust policies

If you are using the eks.Cluster or eks.FargateCluster construct we need you to take action. Other users are not affected and can stop reading. Impact The AWS Cloud Development Kit CDK allows for the definition of Amazon Elastic Container Service for Kubernetes EKS clusters. eks.Cluster and...

cdk.fr Cross Site Scripting vulnerability OBB-2772411

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in cdk-fargate-fastautlscaler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e260e5b4fb3ed0a88f574aefc97fbf1f3f30c4ff51173df70f9e8be14c8b8d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1856 Malicious code in cdk-fargate-fastautlscaler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e260e5b4fb3ed0a88f574aefc97fbf1f3f30c4ff51173df70f9e8be14c8b8d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cdk-plugin-isengard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d74cf2437ab7dad54bc33e2531c100c164e5b465fa594dc29bbf714b5acad92e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1857 Malicious code in cdk-plugin-isengard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d74cf2437ab7dad54bc33e2531c100c164e5b465fa594dc29bbf714b5acad92e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discovery-cdk-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8a4787f713576131289d8f64af45b9a1f78db748def08ebaef692e3d6398ca9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2532 Malicious code in discovery-cdk-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8a4787f713576131289d8f64af45b9a1f78db748def08ebaef692e3d6398ca9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in twinit-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ef9e3b0a0b08d37d71d8ae72b71ed7cb9a2c57ad01a894ee4965147844a0a68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vagrant-s3-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95fdb622795c0f71d0fe9c1606e85995be5d8e5c7e1f8ab6fb05385be0324375 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6696 Malicious code in twinit-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ef9e3b0a0b08d37d71d8ae72b71ed7cb9a2c57ad01a894ee4965147844a0a68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6887 Malicious code in vagrant-s3-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95fdb622795c0f71d0fe9c1606e85995be5d8e5c7e1f8ab6fb05385be0324375 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in teamcity-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d43679749ce4f935d1aaf7ad46f0232c59de752ea62b9f231b9226b4b25e0480 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6435 Malicious code in teamcity-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d43679749ce4f935d1aaf7ad46f0232c59de752ea62b9f231b9226b4b25e0480 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in artifactory-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9674a280d091d3ecb0071c6fc0687be3f01662dd45df2effce8d90143966703 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...