aws / aws-parallelcluster-ui

Apache License 2.0
31 stars 20 forks source link

[Security] Address vulnerabilities: upgrade cryptography from 42.0.2 to 42.0.4 and specify JWT algorithms to decode. #342

Closed gmarciani closed 1 month ago

gmarciani commented 1 month ago

Changes

  1. Upgrade cryptography from 42.0.2 to 42.0.4 to address vulnerability https://github.com/aws/aws-parallelcluster-ui/security/dependabot/30
  2. Specify JWT algorithms to decode tokens to address vulnerability https://github.com/aws/aws-parallelcluster-ui/security/dependabot/33. We specify the accepted algorithms to be [RS256] as suggested by Amazon Cognito.

How Has This Been Tested?

  1. Deployed in personal environment
  2. Verified that login/logout works
  3. Verified that PCUI is able to list clusters in a region

PR Quality Checklist

In order to increase the likelihood of your contribution being accepted, please make sure you have read both the Contributing Guidelines and the Project Guidelines

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.