[Snyk] Security upgrade com.amazonaws:aws-java-sdk from 1.11.505 to 1.12.722

[rahulroycontractor]

User description

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • localstack/ext/java/pom.xml

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Upgrade	Breaking Change	Exploit Maturity	Reachability
	115/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00662, Social Trends: No, Days since published: 976, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.91, Score Version: V5	Denial of Service (DoS) SNYK-JAVA-IONETTY-1584063	com.amazonaws:aws-java-sdk: 1.11.505 -> 1.12.722	No	No Known Exploit	No Path Found
	115/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00662, Social Trends: No, Days since published: 976, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.91, Score Version: V5	Denial of Service (DoS) SNYK-JAVA-IONETTY-1584064	com.amazonaws:aws-java-sdk: 1.11.505 -> 1.12.722	No	No Known Exploit	No Path Found
	88/1000 Why? Confidentiality impact: None, Integrity impact: High, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): Required, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00241, Social Trends: No, Days since published: 886, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.45, Score Version: V5	HTTP Request Smuggling SNYK-JAVA-IONETTY-2314893	com.amazonaws:aws-java-sdk: 1.11.505 -> 1.12.722	No	No Known Exploit	No Path Found
	75/1000 Why? Confidentiality impact: High, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Local, EPSS: 0.00044, Social Trends: No, Days since published: 737, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.24, Score Version: V5	Information Exposure SNYK-JAVA-IONETTY-2812456	com.amazonaws:aws-java-sdk: 1.11.505 -> 1.12.722	No	No Known Exploit	No Path Found
	114/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00059, Social Trends: No, Days since published: 328, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.89, Score Version: V5	Denial of Service (DoS) SNYK-JAVA-IONETTY-5725787	com.amazonaws:aws-java-sdk: 1.11.505 -> 1.12.722	No	No Known Exploit	No Path Found
	67/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00045, Social Trends: No, Days since published: 49, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.81, Score Version: V5	Allocation of Resources Without Limits or Throttling SNYK-JAVA-IONETTY-6483812	com.amazonaws:aws-java-sdk: 1.11.505 -> 1.12.722	No	Proof of Concept	No Path Found

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Denial of Service (DoS)

---

PR Type

Enhancement

---

Description

• This PR updates the aws-java-sdk version to 1.12.722 to address multiple security vulnerabilities linked with the older version.
• The upgrade is applied in two sections of the pom.xml file, ensuring that the newer, more secure version is used both in the main dependencies and within a specific profile.

---

Changes walkthrough 📝

	Relevant files
Dependencies	pom.xml Update AWS Java SDK to Resolve Security Vulnerabilities    localstack/ext/java/pom.xml Updated the version of aws-java-sdk from 1.11.505 to 1.12.722 in two places within the file. +2/-2

---

💡 PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

[codiumai-pr-agent-pro]

PR Description updated to latest commit (cf87bb1)

• Copy walkthrough table to "Files Changed" Tab

[codiumai-pr-agent-pro]

PR Review 🔍

⏱️ Estimated effort to review [1-5]	1, because the PR involves a straightforward version update of a dependency in a Maven project. The changes are limited to updating the version number in the pom.xml file, which is a simple and common task.
🧪 Relevant tests	No
⚡ Possible issues	No
🔒 Security concerns	No

[codiumai-pr-agent-pro]

PR Code Suggestions ✨

Category	Suggestion	Score
Best practice	Test thoroughly after updating dependency versions to avoid compatibility issues After updating the version of aws-java-sdk, it is advisable to perform thorough testing to ensure that the newer version does not introduce any compatibility issues with existing code. This includes unit testing, integration testing, and possibly staging deployments depending on the criticality of the application. localstack/ext/java/pom.xml [87] +<!-- Ensure to test thoroughly after version update --> <version>1.12.722</version> Suggestion importance[1-10]: 8 Why: Testing after updating dependencies is crucial to ensure compatibility and stability, making this a very relevant and important suggestion. It addresses potential risks associated with version changes.	8
	Use a version range for dependencies to automatically incorporate minor updates and patches Consider specifying a version range for aws-java-sdk instead of a fixed version to accommodate automatic patch updates which could include important security patches or minor bug fixes. This can help maintain the security and stability of your application without manual intervention for each minor release. localstack/ext/java/pom.xml [87] -<version>1.12.722</version> +<version>[1.12,1.13)</version> Suggestion importance[1-10]: 6 Why: Suggesting a version range can help in automatically incorporating minor updates and patches, which is a good practice for maintaining up-to-date dependencies. However, it's not a critical change and depends on project policies regarding dependency management.	6
Maintainability	Ensure the dependency scope is correctly set according to the deployment needs Verify if the scope provided is appropriate for the aws-java-sdk dependency. If this SDK is expected to be provided by the environment running your application, such as a web server or application server, this is correct. However, if this SDK is required at runtime and not provided externally, consider changing the scope to compile to ensure it is included in the deployment package. localstack/ext/java/pom.xml [88] -<scope>provided</scope> +<scope>compile</scope> Suggestion importance[1-10]: 7 Why: The suggestion to verify the dependency scope is relevant and important for ensuring correct behavior of the application in production environments. However, without specific knowledge of the deployment environment, it's hard to judge the necessity of changing the scope.	7
	Document the reason for specific version updates in the code Consider adding a comment next to the version update line to document the reason for this specific version choice, especially if it relates to addressing a security vulnerability. This can be helpful for future maintenance and understanding the historical context of changes. localstack/ext/java/pom.xml [87] -<version>1.12.722</version> +<version>1.12.722</version> <!-- Updated to address CVE-XXXX-XXXX --> Suggestion importance[1-10]: 5 Why: Adding comments for version updates can aid in future maintenance and understanding the context of changes, which is a good practice. However, it's a relatively minor improvement in terms of code quality or functionality.	5