Rud5G

---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: auto-vpa-creation
  annotations:
    policies.kyverno.io/title: Add default VPA
    policies.kyverno.io/category: Cost Optimization
    policies.kyverno.io/subject: Vertical Pod Autoscaler
    policies.kyverno.io/description: >-

Rud5G

AWSTemplateFormatVersion: 2010-09-09
Description: >
  Template for creating S3 bucket and DynamoDB table to hold Terraform state and locks
  Validate: aws cloudformation validate-template --template-body file://terraform_state.yml
  Deploy: aws cloudformation create-stack --region us-east-1 --stack-name Terraform-State-Resources --enable-termination-protection --template-body file://terraform_state.yml --parameters ParameterKey=TerraformStateBucketPrefix,ParameterValue=terraform-state ParameterKey=TerraformStateLockTableName,ParameterValue=terraform-state-locks
Parameters:
  TerraformStateBucketPrefix:
    Type: String
    Default: terraform-state
    Description: A prefix for S3 bucket name, account id will be added to ensure global uniqueness

Rud5G

import * as cdk from 'aws-cdk-lib';
import * as pipelines from 'aws-cdk-lib/pipelines';

import { Construct } from 'constructs';
import { PipelineStage } from '../pipeline-stage/pipeline-stage';
import { environments } from '../pipeline-config/pipeline-config';

export class PipelineStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

Rud5G

import * as apigw from 'aws-cdk-lib/aws-apigateway';
import * as cdk from 'aws-cdk-lib';
import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as nodeLambda from 'aws-cdk-lib/aws-lambda-nodejs';
import * as path from 'path';
import * as s3 from 'aws-cdk-lib/aws-s3';

import { Construct } from 'constructs';

Rud5G

import * as cdk from 'aws-cdk-lib';
import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
import * as s3 from 'aws-cdk-lib/aws-s3';

import { Construct } from 'constructs';
import { RemovalPolicy } from 'aws-cdk-lib';

export interface StatefulStackProps extends cdk.StackProps {
  bucketName: string;
}

Rud5G

import * as cdk from 'aws-cdk-lib';

import { Construct } from 'constructs';
import { EnvironmentConfig } from '../pipeline-types/pipeline-types';
import { StatefulStack } from '../../app/stateful/stateful-stack';
import { StatelessStack } from '../../app/stateless/stateless-stack';

// this is our stage made up of multiple stacks which will be deployed to various environments
// based on config i.e. feature-dev, staging, prod, which also includes our application config
export class PipelineStage extends cdk.Stage {

Rud5G

import * as dotenv from 'dotenv';

import {
  Account,
  EnvironmentConfig,
  Region,
  Stage,
} from '../pipeline-types/pipeline-types';

dotenv.config();

Rud5G

export interface EnvironmentConfig {
  env: {
    account: string;
    region: string;
  };
  stageName: string;
  stateful: {
    bucketName: string;
  };
  stateless: {

Rud5G

...

// add the feature-dev stage with the relevant environment config to the pipeline
// this is the test stage (beta)
const featureDevStage: PipelineStage = new PipelineStage(
  this,
  'FeatureDev',
  {
    ...environments.featureDev,
  }

Rud5G

APSB23-50

https://helpx.adobe.com/security/products/magento/apsb23-50.html

Privilege Escalation

The vulnerability with the highest CVSS score of 8.8 (CVE-2023-38218) states that it is an unauthenticated privilege escalation due to improper input validation.

If we look at the diff we see a number of security related changes. One of those changes is the following in Magento\Customer\Plugin\Webapi\Controller\Rest\ValidateCustomerData::validateInputData: