CVE-2023-35165 AWS CDK EKS overly permissive trust policies

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

CVE-2023-35165

CVE-2023-35165 concerns the AWS CDK EKS trust policies. In affected releases of aws-cdk-lib (2.0.0–2.80.0) and @aws-cdk/aws-eks (1.57.0–1.202.0), eks.Cluster and eks.FargateCluster create two roles, CreationRole and default MastersRole, with overly permissive trust policies. The CreationRole is u...

CVE-2023-35165 AWS CDK EKS overly permissive trust policies

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

CVE-2023-35165: Incorrect Authorization

AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages aws-cdk-lib 2.0.0 until 2.80.0 and @aws-cdk/aws-eks 1.57.0 until 1.202.0, eks.Cluster and eks.FargateCluster...

@104corp/cdk-aws-codedeploy-on-premises (>=1.0.0, <=1.0.2), @aws-cdk/aws-stepfunctions-tasks (>=1.91.0, <=1.201.0) +30 more potentially affected by CVE-2023-35165 via @aws-cdk/aws-eks (>=1.57.0, <=1.201.0)

@aws-cdk/aws-eks NPM version =1.57.0, =1.0.0, =1.91.0, =1.57.0, =0.12.1, =1.115.0, =1.91.0, =1.91.0, =1.115.0, =0.0.1-beta.1, =0.0.1, =25.1.0, =0.2.0, =0.1.0, =0.3.2 and more Source cves: CVE-2023-35165 Source advisory: OSV:GHSA-RX28-R23P-2QC3...

AWS CDK EKS overly permissive trust policies

If you are using the eks.Cluster or eks.FargateCluster construct we need you to take action. Other users are not affected and can stop reading. Impact The AWS Cloud Development Kit CDK allows for the definition of Amazon Elastic Container Service for Kubernetes EKS clusters. eks.Cluster and...

GHSA-RX28-R23P-2QC3 AWS CDK EKS overly permissive trust policies

If you are using the eks.Cluster or eks.FargateCluster construct we need you to take action. Other users are not affected and can stop reading. Impact The AWS Cloud Development Kit CDK allows for the definition of Amazon Elastic Container Service for Kubernetes EKS clusters. eks.Cluster and...

PT-2023-25176 · Amazon · @Aws-Cdk/Aws-Eks +2

Name of the Vulnerable Software and Affected Versions: aws-cdk-lib versions 2.0.0 through 2.80.0 @aws-cdk/aws-eks versions 1.57.0 through 1.202.0 Description: The issue concerns the AWS Cloud Development Kit AWS CDK, an open-source software development framework. In the affected packages,...

CVE-2022-41723 vulnerabilities

Vulnerabilities for packages: kubeflow, wireguard-go, restic, kubeflow-katib, terraform-provider-sendgrid, k3d, terraform-provider-sendgrid-fips, grpcurl, kube-state-metrics, gke-gcloud-auth-plugin, dynamic-localpv-provisioner, hey, go, kubeflow-fips, dynamic-localpv-provisioner-fips...

GHSA-VVPX-J8F3-3W6H vulnerabilities

Vulnerabilities for packages: kubeflow, wireguard-go, restic, kubeflow-katib, terraform-provider-sendgrid, k3d, terraform-provider-sendgrid-fips, grpcurl, kube-state-metrics, gke-gcloud-auth-plugin, dynamic-localpv-provisioner, hey, go, kubeflow-fips, dynamic-localpv-provisioner-fips...

GHSA-GWC9-M7RH-J2WW vulnerabilities

Vulnerabilities for packages: kubeflow, terraform-provider-sendgrid, k3d, terraform-provider-sendgrid-fips, dynamic-localpv-provisioner, kubeflow-fips, dynamic-localpv-provisioner-fips...

GHSA-69CG-P879-7622 vulnerabilities

Vulnerabilities for packages: kubeflow, kubeflow-katib, terraform-provider-sendgrid, k3d, terraform-provider-sendgrid-fips, grpcurl, kube-state-metrics, dynamic-localpv-provisioner, hey, wireguard-go, kubeflow-fips, dynamic-localpv-provisioner-fips...

CVE-2022-27664 vulnerabilities

Vulnerabilities for packages: kubeflow, kubeflow-katib, terraform-provider-sendgrid, k3d, terraform-provider-sendgrid-fips, grpcurl, kube-state-metrics, dynamic-localpv-provisioner, hey, wireguard-go, kubeflow-fips, dynamic-localpv-provisioner-fips...

CVE-2021-43565 vulnerabilities

Vulnerabilities for packages: kubeflow, terraform-provider-sendgrid, k3d, terraform-provider-sendgrid-fips, dynamic-localpv-provisioner, kubeflow-fips, dynamic-localpv-provisioner-fips...

Fedora: Security Advisory for golang-sigs-k8s-aws-iam-authenticator (FEDORA-2022-5038c3236c)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-sigs-k8s-aws-iam-authenticator-0.5.2-8.fc36

A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster. The initial work on this tool was driven by Heptio. The project receives contributions from multiple community engineers and is currently maintained by Heptio and Amazon EKS OSS Engineers...

GHSA-P782-XGP4-8HR8 vulnerabilities

Vulnerabilities for packages: kubeflow, terraform-provider-sendgrid, k3d, terraform-provider-sendgrid-fips, grpcurl, dynamic-localpv-provisioner, ctop, kind, dynamic-localpv-provisioner-fips...

Malicious code in eks-auto-create-idp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abe5220ea6202484d070bbe62ba66ccb40f7d0b230bcfb2a4208d4aec4877ac7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2682 Malicious code in eks-auto-create-idp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abe5220ea6202484d070bbe62ba66ccb40f7d0b230bcfb2a4208d4aec4877ac7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in callrail_eks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a04c2e632af57414931941b9d17e0edb9dc7883a968f5c96670cff845f32638 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...