[4.0.4] - 2024-09-23

Fixed

• Patched dependency version of requests to 2.32.3 to mitigate CVE-2024-3651
• Pinned all dependencies to specific versions for reproducable builds and enable security scanning
• Allow to install latest version of urllib3 as transitive dependency

v4.0.3

[4.0.3] - 2023-10-25

Fixed

• Patched urllib3 vulnerability as it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. For more details: CVE-2023-43804

v4.0.2

[4.0.2] - 2023-09-11

Fixed

• Update trademarked name. From aws-waf-security-automations.zip to security-automations-for-aws-waf.zip
• Refactor to reduce code complexity
• Patched requests package vulnerability leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. For more details: CVE-2023-32681 Github issue 248

v4.0.1

Fixed

• Updated gitignore files to resolve the issue for missing files #243, #244, #245

v4.0.0

Added

• Added support for 10 new AWS Managed Rules rule groups (AMR)
• Added support for country and URI configurations in HTTP Flood Athena log parser
• Added support for user-defined S3 prefix for application access log bucket
• Added support for CloudWatch log retention period configuration
• Added support for multiple solution deployments in the same account and region
• Added support for exporting CloudFormation stack output values
• Replaced the hard coded amazonaws.com with {AWS::URLSuffix} in BadBotHoneypot API endpoint

Fixed

• Avoid account-wide API Gateway logging setting change by deleting the solution stack GitHub issue 213
• Avoid creating a new logging bucket for an existing app access log bucket that already has logging enabled

v3.2.5

[3.2.5] - 2023-04-18

Patched

• Patch s3 logging bucket settings
• Updated the timeout for requests

v3.2.4

[3.2.4] - 2023-02-06

Changed

• Upgraded pytest to mitigate CVE-2022-42969
• Upgraded requests and subsequently certifi to mitigate CVE-2022-23491

v3.2.3

[3.2.3] - 2022-12-13

Changed

• Add region as prefix to application attribute group name to avoid conflict with name starting with AWS.

v3.2.2

[3.2.2] - 2022-12-05

Added

• Added AppRegistry integration

v3.2.1

[3.2.1] - 2022-08-30

Added

• Added support for configuring oversize handling for requests components.
• Added support for configuring sensitivity level for SQL injection rule.