HIGH

GHSA-g43v-9x7q-83pq

@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass

Quick fix

GHSA-g43v-9x7q-83pq — @hulumi/policies: upgrade to the fixed version with the command below.

npm install @hulumi/policies@1.3.2

Details

Impact: @hulumi/policies versions before 1.3.2 could accept spoofed SecureBucket parent evidence for HULUMI-H1, allowing policy evaluation to miss an unsafe bucket shape.

Patched in 1.3.2: the validator now correlates evidence to the expected component/resource relationship and includes regression coverage.

Remediation: upgrade @hulumi/policies to 1.3.2 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@hulumi/policies

Introduced in: 0Fixed in: 1.3.2

Fixnpm install @hulumi/policies@1.3.2

References

https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g43v-9x7q-83pq[WEB]
https://github.com/kerberosmansour/hulumi[PACKAGE]