Reporting a vulnerability

[igibek]

Hello!

I hope you are doing well!

We are a security research team. Our tool automatically detected a vulnerability in this repository. We want to disclose it responsibly. GitHub has a feature called Private vulnerability reporting, which enables security research to privately disclose a vulnerability. Unfortunately, it is not enabled for this repository.

Can you enable it, so that we can report it?

Thanks in advance!

PS: you can read about how to enable private vulnerability reporting here: https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository

[github-actions]

This issue is now marked as stale because it hasn't seen activity for a while. Add a comment or it will be closed soon. If you wish to exclude this issue from being marked as stale, add the "backlog" label.

[shirk3ysiili]

@igibek Hello!
Can you please share more details about this vulnerability? We plan to use this library in our project, so we want to make sure it doesn't contain any major security bugs.

Thanks in advance!

[aripalo]

@igibek the private vulnerability reporting has now been enabled.

@shirk3ysiili I'm pretty sure that the vulnerability is one of the dependency vulnerabilities found also by DependaBot alerts (as often these kinds of issues are opened automatically by security research companies when they run security analysis tools that can be compared to DependaBot). Unfortunately I've missed those as DependaBot PRs haven't been enabled for some reason (they were previously, not sure what happened, maybe I've accidentally disabled those)

• At really quick glance it seems the vulnerabilities seem not to affect the deployed configurations any way, but instead require that some untrusted code would be calling the affected dependencies of this construct (which shouldn't be the case when you're running CDK in a trusted environment)
• That being said, I'll patch these soon: Patch vulnerable dependencies #25

[aripalo]

I'm closing this issue as the original issue (enabling private vuln reporting) is done and also the current vulns are now patched via #28