{"url":"http://public2.vulnerablecode.io/api/packages/635436?format=json","purl":"pkg:npm/aws-cdk-lib@2.65.0","type":"npm","namespace":"","name":"aws-cdk-lib","version":"2.65.0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"2.189.1","latest_non_vulnerable_version":"2.189.1","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/137946?format=json","vulnerability_id":"VCID-916a-bfkj-yyh7","summary":"AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages `aws-cdk-lib` 2.0.0 until 2.80.0 and `@aws-cdk/aws-eks` 1.57.0 until 1.202.0, `eks.Cluster` and `eks.FargateCluster` constructs create two roles, `CreationRole` and `default MastersRole`, that have an overly permissive trust policy. \n \nThe first, referred to as the `CreationRole`, is used by lambda handlers to create the cluster and deploy Kubernetes resources (e.g `KubernetesManifest`, `HelmChart`, ...) onto it. Users with CDK version higher or equal to 1.62.0 (including v2 users) may be affected.\n \nThe second, referred to as the `default MastersRole`, is provisioned only if the `mastersRole` property isn't provided and has permissions to execute `kubectl` commands on the cluster. Users with CDK version higher or equal to 1.57.0 (including v2 users) may be affected.\n\nThe issue has been fixed in `@aws-cdk/aws-eks` v1.202.0 and `aws-cdk-lib` v2.80.0. These versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. There is no workaround available for CreationRole. To avoid creating the `default MastersRole`, use the `mastersRole` property to explicitly provide a role.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-35165","reference_id":"","reference_type":"","scores":[{"value":"0.00065","scoring_system":"epss","scoring_elements":"0.20361","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-35165"},{"reference_url":"https://github.com/aws/aws-cdk","reference_id":"","reference_type":"","scores":[{"value":"6.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/aws-cdk"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35165","reference_id":"","reference_type":"","scores":[{"value":"6.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35165"},{"reference_url":"https://github.com/aws/aws-cdk/issues/25674","reference_id":"25674","reference_type":"","scores":[{"value":"6.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-12-05T16:12:30Z/"}],"url":"https://github.com/aws/aws-cdk/issues/25674"},{"reference_url":"https://github.com/aws/aws-cdk/security/advisories/GHSA-rx28-r23p-2qc3","reference_id":"GHSA-rx28-r23p-2qc3","reference_type":"","scores":[{"value":"6.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-12-05T16:12:30Z/"}],"url":"https://github.com/aws/aws-cdk/security/advisories/GHSA-rx28-r23p-2qc3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/381680?format=json","purl":"pkg:npm/aws-cdk-lib@2.80.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-bssn-gvuq-xkdc"},{"vulnerability":"VCID-xm6e-11vq-uugw"},{"vulnerability":"VCID-zcjw-fryj-uqem"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/aws-cdk-lib@2.80.0"}],"aliases":["CVE-2023-35165","GHSA-rx28-r23p-2qc3"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-916a-bfkj-yyh7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/360689?format=json","vulnerability_id":"VCID-bssn-gvuq-xkdc","summary":"aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct\n### Summary\nThe [AWS Cloud Development Kit (CDK)](https://aws.amazon.com/cdk/) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called \"[constructs](https://docs.aws.amazon.com/cdk/v2/guide/constructs.html)\" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates.\n\nThe CDK [Cognito UserPool](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.UserPool.html) construct deploys an AWS cognito user pool. An [Amazon Cognito user pool](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools.html) is a user directory for web and mobile app authentication and authorization. Customers can deploy a client under this user pool through construct ‘[UserPoolClient](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.UserPoolClient.html)’ or through helper method '[addClient](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.UserPool.html#addwbrclientid-options)'. A user pool client resource represents an Amazon [Cognito user pool client](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-client-apps.html) which is a configuration within a user pool that interacts with one mobile or web application authenticating with Amazon Cognito. \n\n\nWhen users of the 'cognito.UserPoolClient' construct generate a secret value for the application client in AWS CDK, they can then reference the generated secrets in their stack. The CDK had an issue where, when the custom resource performed an SDK API call to 'DescribeCognitoUserPoolClient' to retrieve the generated secret, the full response was logged in the associated lambda function's log group. Any user authenticated in the account where logs of the custom resource are accessible and who has read-only permission could view the secret written to those logs. \n\nThis issue does not affect customers who are generating the secret value outside of the CDK as the secret is not referenced or logged.\n\n### Impact\nTo leverage this issue, an actor has to be authenticated in the account where logs of the custom resource Custom::DescribeCognitoUserPoolClient are accessible and have read-only permission for lambda function logs. \n\nUsers can review access to their log group through AWS CloudTrail logs to detect any unexpected access to read the logs.\n\n**Impacted versions: >2.37.0 and <=2.187.0**\n\n### Patches\nThe patches are included in the AWS CDK Library release v2.187.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. To fully address this issue, users should rotate the secret by generating a new secret stored in AWS Secrets Manager. References to the secret will use the new secret on update. \n\nWhen new CDK applications using the latest version are initialized, they will use the new behavior with updated logging. \n\nExisting applications must upgrade to the latest version, change the [feature flag](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/cx-api/FEATURE_FLAGS.md) (@aws-cdk/cognito:logUserPoolClientSecretValue) to false, redeploy the application to apply this fix and use the new implementation with updated logging behavior.\n\n### Workarounds\nUsers can override the implementation changing Logging to be Logging.withDataHidden(). For example define class CustomUserPoolClient extends UserPoolClient and  in the new class define get userPoolClientSecret() to use Logging.withDataHidden().\n\n\n\nExample\n\n    export class CustomUserPoolClient extends UserPoolClient {\n\n      private readonly customUserPool : UserPool;\n      private readonly customuserPoolClientId : string;\n      constructor(scope: Construct, id: string, props: UserPoolClientProps) {\n        super(scope, id, props);\n\n        this.customUserPool = new UserPool(this, 'pool', {\n          removalPolicy: RemovalPolicy.DESTROY,\n        });\n\n        const client = this.customUserPool.addClient('client', { generateSecret: true });\n      }\n\n\n\n      // Override the userPoolClientSecret getter to always return the secret\n      public get userPoolClientSecret(): SecretValue {\n        // Create the Custom Resource that assists in resolving the User Pool Client secret\n        const secretValue = SecretValue.resourceAttribute(new AwsCustomResource(\n          this,\n          'DescribeCognitoUserPoolClient',\n          {\n        resourceType: 'Custom::DescribeCognitoUserPoolClient',\n        onUpdate: {\n          region: cdk.Stack.of(this).region,\n          service: 'CognitoIdentityServiceProvider',\n          action: 'describeUserPoolClient',\n          parameters: {\n            UserPoolId: this.customUserPool.userPoolId,\n            ClientId: this.customUserPool,\n          },\n          physicalResourceId: PhysicalResourceId.of(this.userPoolClientId),\n          // Disable logging of sensitive data\n          logging: Logging.withDataHidden(),\n        },\n        policy: AwsCustomResourcePolicy.fromSdkCalls({\n          resources: [this.customUserPool.userPoolArn],\n        }),\n        installLatestAwsSdk: false,\n          },\n        ).getResponseField('UserPoolClient.ClientSecret'));\n        \n        return secretValue;\n      }\n    }\n\n\n\n### References\nIf you have any questions or comments about this advisory please contact AWS/Amazon Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.","references":[{"reference_url":"https://github.com/aws/aws-cdk","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/aws-cdk"},{"reference_url":"https://github.com/aws/aws-cdk/commit/d02e64aac18a72195ddcdb973defea7f32382c33","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/aws-cdk/commit/d02e64aac18a72195ddcdb973defea7f32382c33"},{"reference_url":"https://github.com/aws/aws-cdk/security/advisories/GHSA-qq4x-c6h6-rfxh","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/aws-cdk/security/advisories/GHSA-qq4x-c6h6-rfxh"},{"reference_url":"https://github.com/advisories/GHSA-qq4x-c6h6-rfxh","reference_id":"GHSA-qq4x-c6h6-rfxh","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-qq4x-c6h6-rfxh"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/377898?format=json","purl":"pkg:npm/aws-cdk-lib@2.187.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-r7vk-5d1n-wqbj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/aws-cdk-lib@2.187.0"}],"aliases":["GHSA-qq4x-c6h6-rfxh"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bssn-gvuq-xkdc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/91323?format=json","vulnerability_id":"VCID-xm6e-11vq-uugw","summary":"The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow. However, the current `tls.connect` method will always set `rejectUnauthorized: false` which is a potential security concern. CDK should follow the best practice and set `rejectUnauthorized: true`. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag. Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack. The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22). Once upgraded, users should make sure the feature flag '@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in `cdk.context.json` or `cdk.json`. There are no known workarounds for this vulnerability.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-23206","reference_id":"","reference_type":"","scores":[{"value":"0.00092","scoring_system":"epss","scoring_elements":"0.25878","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-23206"},{"reference_url":"https://github.com/aws/aws-cdk","reference_id":"","reference_type":"","scores":[{"value":"1.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/aws-cdk"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23206","reference_id":"","reference_type":"","scores":[{"value":"1.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23206"},{"reference_url":"https://github.com/aws/aws-cdk/issues/32920","reference_id":"32920","reference_type":"","scores":[{"value":"1.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-17T20:59:53Z/"}],"url":"https://github.com/aws/aws-cdk/issues/32920"},{"reference_url":"https://github.com/aws/aws-cdk/pull/32921","reference_id":"32921","reference_type":"","scores":[{"value":"1.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-17T20:59:53Z/"}],"url":"https://github.com/aws/aws-cdk/pull/32921"},{"reference_url":"https://github.com/aws/aws-cdk/commit/3e4f3773bfa48b75bf0adc7d53d46bbec7714a9e#diff-38a03353f201fd2e520df67fb43f9f000257bffd6e9acaa5569cce7005a77560","reference_id":"3e4f3773bfa48b75bf0adc7d53d46bbec7714a9e#diff-38a03353f201fd2e520df67fb43f9f000257bffd6e9acaa5569cce7005a77560","reference_type":"","scores":[{"value":"1.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-17T20:59:53Z/"}],"url":"https://github.com/aws/aws-cdk/commit/3e4f3773bfa48b75bf0adc7d53d46bbec7714a9e#diff-38a03353f201fd2e520df67fb43f9f000257bffd6e9acaa5569cce7005a77560"},{"reference_url":"https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34","reference_id":"external.ts#L34","reference_type":"","scores":[{"value":"1.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-17T20:59:53Z/"}],"url":"https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34"},{"reference_url":"https://docs.aws.amazon.com/cdk/v2/guide/featureflags.html","reference_id":"featureflags.html","reference_type":"","scores":[{"value":"1.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-17T20:59:53Z/"}],"url":"https://docs.aws.amazon.com/cdk/v2/guide/featureflags.html"},{"reference_url":"https://github.com/advisories/GHSA-v4mq-x674-ff73","reference_id":"GHSA-v4mq-x674-ff73","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-v4mq-x674-ff73"},{"reference_url":"https://github.com/aws/aws-cdk/security/advisories/GHSA-v4mq-x674-ff73","reference_id":"GHSA-v4mq-x674-ff73","reference_type":"","scores":[{"value":"1.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-17T20:59:53Z/"}],"url":"https://github.com/aws/aws-cdk/security/advisories/GHSA-v4mq-x674-ff73"},{"reference_url":"https://github.com/aws/aws-cdk/releases/tag/v2.177.0","reference_id":"v2.177.0","reference_type":"","scores":[{"value":"1.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-17T20:59:53Z/"}],"url":"https://github.com/aws/aws-cdk/releases/tag/v2.177.0"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/376951?format=json","purl":"pkg:npm/aws-cdk-lib@2.177.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-bssn-gvuq-xkdc"},{"vulnerability":"VCID-r7vk-5d1n-wqbj"},{"vulnerability":"VCID-zcjw-fryj-uqem"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/aws-cdk-lib@2.177.0"}],"aliases":["CVE-2025-23206","GHSA-v4mq-x674-ff73"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xm6e-11vq-uugw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/360684?format=json","vulnerability_id":"VCID-zcjw-fryj-uqem","summary":"AWS CDK CodePipeline: trusted entities are too broad\n### Summary\n\nThe [AWS Cloud Development Kit (CDK)](https://aws.amazon.com/cdk/) is an open-source framework for defining cloud infrastructure using code. Users use it to create their own applications, which are converted to AWS CloudFormation templates during deployment to a user's AWS account. AWS CDK contains pre-built components called \"constructs,\" which are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates.\n\nThe [AWS CodePipeline](https://aws.amazon.com/codepipeline/) construct deploys CodePipeline, a managed service that orchestrates software release processes through a series of stages, each comprising one or more actions executed by CodePipeline. To perform these actions, CodePipeline assumes IAM roles with permissions necessary for each step, allowing it to interact with AWS services and resources on behalf of the user.\n\nAn issue exists where, when using CDK to create a CodePipeline with the CDK Construct Library, CDK creates an AWS Identity and Access Management (AWS IAM) trust policy with overly broad permissions. Any user with unrestricted sts:AssumeRole permissions could assume that trust policy. This issue does not affect users who supply their own role for CodePipeline.\n\n### Impact\nTo leverage the issue, an actor has to be authenticated in the account and have an unrestricted sts:AssumeRole permission. The permissions an actor could leverage depend on the actions added to the pipeline. Possible permissions include actions on services such as CloudFormation, CodeCommit, Lambda, and ECS, as well as access to the S3 bucket holding pipeline build artifacts ([see documentation](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_codepipeline_actions-readme.html)). \n\nUsers can review their AWS CloudTrail logs for when the role was assumed to determine if this was expected. \n\n#### Impacted versions: <v2.189.0\n\n### Patches\nThe patches are included in the CDK Construct Library release [v2.189.0](https://github.com/aws/aws-cdk/releases/tag/v2.189.0). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\nWhen new CDK applications using the latest version are initialized, they will use the new behavior with more restrictive permissions.\n\nExisting applications must upgrade to the latest version, change the [feature flag](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/cx-api/FEATURE_FLAGS.md) (@aws-cdk/pipelines:reduceStageRoleTrustScope)  and (@aws-cdk/pipelines:reduceCrossAccountActionRoleTrustScope) to true and redeploy the application to apply this fix and use the new behavior with more restrictive permissions.\n\n### Workarounds\nYou can explicitly supply the role for your [CodePipeline](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_codepipeline-readme.html#cross-account-codepipelines) and follow the policy recommendations detailed in [CodePipeline documentation](https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-create-cross-account.html).\n\n### References\n[Original reporting issue.](https://github.com/aws/aws-cdk/issues/33709)\n\n\n\nIf you have any questions or comments about this advisory please contact AWS/Amazon Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.","references":[{"reference_url":"https://github.com/aws/aws-cdk","reference_id":"","reference_type":"","scores":[{"value":"3.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/aws-cdk"},{"reference_url":"https://github.com/aws/aws-cdk/commit/a64b01cc2969822bb92d7bd72152ecb2ccf1c1cf","reference_id":"","reference_type":"","scores":[{"value":"3.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/aws-cdk/commit/a64b01cc2969822bb92d7bd72152ecb2ccf1c1cf"},{"reference_url":"https://github.com/aws/aws-cdk/issues/33709","reference_id":"","reference_type":"","scores":[{"value":"3.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/aws-cdk/issues/33709"},{"reference_url":"https://github.com/aws/aws-cdk/releases/tag/v2.184.0","reference_id":"","reference_type":"","scores":[{"value":"3.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/aws-cdk/releases/tag/v2.184.0"},{"reference_url":"https://github.com/aws/aws-cdk/security/advisories/GHSA-5pq3-h73f-66hr","reference_id":"","reference_type":"","scores":[{"value":"3.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/aws-cdk/security/advisories/GHSA-5pq3-h73f-66hr"},{"reference_url":"https://github.com/advisories/GHSA-5pq3-h73f-66hr","reference_id":"GHSA-5pq3-h73f-66hr","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-5pq3-h73f-66hr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/377861?format=json","purl":"pkg:npm/aws-cdk-lib@2.189.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-r7vk-5d1n-wqbj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/aws-cdk-lib@2.189.0"}],"aliases":["GHSA-5pq3-h73f-66hr"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zcjw-fryj-uqem"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/aws-cdk-lib@2.65.0"}