{"action":"Upgrade aws-cdk-lib to 2.177.0 or later.","affected":[{"fixed":"2.177.0","introduced":"0"}],"component":"aws-cdk-lib","cve_ids":["CVE-2025-23206"],"ecosystem":"npm","epss":0.00331,"exploited":false,"fixed_versions":["2.177.0"],"ghsa_id":"GHSA-v4mq-x674-ff73","id":"tcs_01M5KGAQ648EHF0S0JZN68EFJ1","modified_at":"2025-01-29T18:22:28Z","published_at":"2025-01-17T21:22:25Z","references":["https://osv.dev/vulnerability/GHSA-v4mq-x674-ff73","https://github.com/aws/aws-cdk/security/advisories/GHSA-v4mq-x674-ff73","https://nvd.nist.gov/vuln/detail/CVE-2025-23206","https://github.com/aws/aws-cdk/issues/32920","https://github.com/aws/aws-cdk/pull/32921","https://github.com/aws/aws-cdk/commit/3e4f3773bfa48b75bf0adc7d53d46bbec7714a9e#diff-38a03353f201fd2e520df67fb43f9f000257bffd6e9acaa5569cce7005a77560","https://docs.aws.amazon.com/cdk/v2/guide/featureflags.html","https://github.com/aws/aws-cdk","https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34","https://github.com/aws/aws-cdk/releases/tag/v2.177.0"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-v4mq-x674-ff73","url":"https://osv.dev/vulnerability/GHSA-v4mq-x674-ff73"},{"source":"nvd","source_id":"CVE-2025-23206","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23206"}],"summary":"AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider"}