CVE-2025-23206

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-23206
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23206.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-23206
Aliases
Published
2025-01-17T20:34:50.851Z
Modified
2026-03-01T02:54:30.437892Z
Severity
  • 1.8 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk
Details

The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow. However, the current tls.connect method will always set rejectUnauthorized: false which is a potential security concern. CDK should follow the best practice and set rejectUnauthorized: true. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag. Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack. The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22). Once upgraded, users should make sure the feature flag '@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in cdk.context.json or cdk.json. There are no known workarounds for this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-347"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23206.json"
}
References

Affected packages

Git / github.com/aws/aws-cdk

Affected ranges

Type
GIT
Repo
https://github.com/aws/aws-cdk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b396961272695cd70ac183fdaf842ffb48f5d91f

Affected versions

v0.*
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.14.1
v0.15.0
v0.15.1
v0.15.2
v0.16.0
v0.17.0
v0.18.0
v0.18.1
v0.19.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.24.1
v0.25.0
v0.25.2
v0.25.3
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.36.0
v0.36.1
v0.36.2
v0.37.0
v0.38.0
v0.39.0
v0.7.0-beta
v0.7.1-beta
v0.7.2-beta
v0.7.3-beta
v0.7.4-beta
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v0.9.1
v0.9.2
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.100.0
v1.101.0
v1.102.0
v1.103.0
v1.104.0
v1.105.0
v1.106.0
v1.106.1
v1.107.0
v1.108.0
v1.108.1
v1.109.0
v1.11.0
v1.110.0
v1.110.1
v1.111.0
v1.112.0
v1.113.0
v1.114.0
v1.115.0
v1.116.0
v1.117.0
v1.118.0
v1.119.0
v1.12.0
v1.120.0
v1.121.0
v1.122.0
v1.123.0
v1.124.0
v1.125.0
v1.126.0
v1.127.0
v1.128.0
v1.129.0
v1.13.0
v1.13.1
v1.130.0
v1.131.0
v1.132.0
v1.133.0
v1.134.0
v1.135.0
v1.136.0
v1.137.0
v1.138.0
v1.138.1
v1.138.2
v1.139.0
v1.14.0
v1.140.0
v1.141.0
v1.142.0
v1.143.0
v1.144.0
v1.145.0
v1.146.0
v1.147.0
v1.148.0
v1.149.0
v1.15.0
v1.150.0
v1.151.0
v1.152.0
v1.153.0
v1.153.1
v1.154.0
v1.155.0
v1.156.0
v1.156.1
v1.157.0
v1.158.0
v1.16.0
v1.16.1
v1.17.0
v1.17.1
v1.18.0
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.21.1
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.32.1
v1.32.2
v1.33.0
v1.33.1
v1.34.0
v1.34.1
v1.35.0
v1.36.0
v1.37.0
v1.38.0
v1.39.0
v1.4.0
v1.40.0
v1.41.0
v1.42.0
v1.42.1
v1.43.0
v1.44.0
v1.45.0
v1.46.0
v1.47.0
v1.47.1
v1.48.0
v1.49.0
v1.49.1
v1.5.0
v1.50.0
v1.51.0
v1.52.0
v1.53.0
v1.54.0
v1.55.0
v1.56.0
v1.57.0
v1.58.0
v1.59.0
v1.6.0
v1.6.1
v1.60.0
v1.61.0
v1.61.1
v1.62.0
v1.63.0
v1.64.0
v1.64.1
v1.65.0
v1.66.0
v1.67.0
v1.68.0
v1.69.0
v1.7.0
v1.70.0
v1.71.0
v1.72.0
v1.73.0
v1.74.0
v1.75.0
v1.76.0
v1.77.0
v1.78.0
v1.79.0
v1.8.0
v1.80.0
v1.81.0
v1.82.0
v1.83.0
v1.84.0
v1.85.0
v1.86.0
v1.87.0
v1.87.1
v1.88.0
v1.89.0
v1.9.0
v1.90.0
v1.90.1
v1.91.0
v1.92.0
v1.93.0
v1.94.0
v1.94.1
v1.95.0
v1.95.1
v1.95.2
v1.96.0
v1.97.0
v1.98.0
v1.99.0
v2.*
v2.0.0
v2.0.0-alpha.0
v2.0.0-alpha.1
v2.0.0-alpha.10
v2.0.0-alpha.11
v2.0.0-alpha.12
v2.0.0-alpha.13
v2.0.0-alpha.14
v2.0.0-alpha.2
v2.0.0-alpha.3
v2.0.0-alpha.4
v2.0.0-alpha.5
v2.0.0-alpha.6
v2.0.0-rc.1
v2.0.0-rc.10
v2.0.0-rc.11
v2.0.0-rc.12
v2.0.0-rc.13
v2.0.0-rc.14
v2.0.0-rc.15
v2.0.0-rc.16
v2.0.0-rc.17
v2.0.0-rc.18
v2.0.0-rc.19
v2.0.0-rc.20
v2.0.0-rc.21
v2.0.0-rc.22
v2.0.0-rc.23
v2.0.0-rc.24
v2.0.0-rc.25
v2.0.0-rc.26
v2.0.0-rc.27
v2.0.0-rc.28
v2.0.0-rc.29
v2.0.0-rc.3
v2.0.0-rc.30
v2.0.0-rc.31
v2.0.0-rc.32
v2.0.0-rc.33
v2.0.0-rc.4
v2.0.0-rc.5
v2.0.0-rc.6
v2.0.0-rc.7
v2.0.0-rc.8
v2.0.0-rc.9
v2.1.0
v2.10.0
v2.100.0
v2.101.0
v2.101.1
v2.102.0
v2.102.1
v2.103.0
v2.103.1
v2.104.0
v2.105.0
v2.106.0
v2.106.1
v2.107.0
v2.108.0
v2.108.1
v2.109.0
v2.11.0
v2.110.0
v2.110.1
v2.111.0
v2.112.0
v2.113.0
v2.114.0
v2.114.1
v2.115.0
v2.116.0
v2.116.1
v2.117.0
v2.118.0
v2.119.0
v2.12.0
v2.120.0
v2.121.0
v2.121.1
v2.122.0
v2.123.0
v2.124.0
v2.125.0
v2.126.0
v2.127.0
v2.128.0
v2.129.0
v2.13.0
v2.130.0
v2.131.0
v2.132.0
v2.132.1
v2.133.0
v2.134.0
v2.135.0
v2.136.0
v2.136.1
v2.137.0
v2.138.0
v2.139.0
v2.139.1
v2.14.0
v2.140.0
v2.141.0
v2.142.0
v2.142.1
v2.143.0
v2.143.1
v2.144.0
v2.145.0
v2.146.0
v2.147.0
v2.147.1
v2.147.2
v2.147.3
v2.148.0
v2.148.1
v2.149.0
v2.15.0
v2.150.0
v2.151.0
v2.151.1
v2.152.0
v2.153.0
v2.154.0
v2.154.1
v2.155.0
v2.156.0
v2.157.0
v2.158.0
v2.159.0
v2.159.1
v2.16.0
v2.160.0
v2.161.0
v2.161.1
v2.162.0
v2.162.1
v2.163.0
v2.163.1
v2.164.0
v2.164.1
v2.165.0
v2.166.0
v2.167.0
v2.167.1
v2.167.2
v2.168.0
v2.169.0
v2.17.0
v2.170.0
v2.171.0
v2.171.1
v2.172.0
v2.173.0
v2.173.1
v2.173.2
v2.173.3
v2.173.4
v2.174.0
v2.174.1
v2.175.0
v2.175.1
v2.176.0
v2.18.0
v2.19.0
v2.2.0
v2.20.0
v2.21.0
v2.21.1
v2.22.0
v2.23.0
v2.24.0
v2.24.1
v2.25.0
v2.26.0
v2.27.0
v2.28.0
v2.28.1
v2.29.0
v2.29.1
v2.3.0
v2.30.0
v2.31.0
v2.31.1
v2.31.2
v2.32.0
v2.32.1
v2.33.0
v2.34.0
v2.34.1
v2.34.2
v2.35.0
v2.36.0
v2.37.0
v2.37.1
v2.38.0
v2.38.1
v2.39.0
v2.39.1
v2.4.0
v2.40.0
v2.41.0
v2.42.0
v2.42.1
v2.43.0
v2.43.1
v2.44.0
v2.45.0
v2.46.0
v2.47.0
v2.48.0
v2.49.0
v2.49.1
v2.5.0
v2.50.0
v2.51.0
v2.51.1
v2.52.0
v2.52.1
v2.53.0
v2.54.0
v2.55.0
v2.55.1
v2.56.0
v2.56.1
v2.57.0
v2.58.0
v2.58.1
v2.59.0
v2.6.0
v2.60.0
v2.61.0
v2.61.1
v2.62.0
v2.62.1
v2.62.2
v2.63.0
v2.63.1
v2.63.2
v2.64.0
v2.65.0
v2.66.0
v2.66.1
v2.67.0
v2.68.0
v2.69.0
v2.7.0
v2.70.0
v2.72.0
v2.72.1
v2.73.0
v2.74.0
v2.75.0
v2.75.1
v2.76.0
v2.77.0
v2.78.0
v2.79.0
v2.79.1
v2.8.0
v2.80.0
v2.81.0
v2.82.0
v2.83.0
v2.83.1
v2.84.0
v2.85.0
v2.86.0
v2.87.0
v2.88.0
v2.89.0
v2.9.0
v2.90.0
v2.91.0
v2.92.0
v2.93.0
v2.94.0
v2.95.0
v2.95.1
v2.96.0
v2.96.1
v2.96.2
v2.97.0
v2.97.1
v2.98.0
v2.99.0
v2.99.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23206.json"