Security¶

Table of Contents¶

Reporting Security Vulnerabilities
Known Vulnerabilities
Security Features
Security Best Practices
Security Scanning
Compliance
Security Update Policy
Incident Response
Version History
Additional Resources

Reporting Security Vulnerabilities¶

If you discover a security vulnerability in VPC Provisioner, please report it to:

Email: security@axontechlabs.com
Response Time: Within 24 hours for critical issues

Please include:

Description of the vulnerability
Steps to reproduce
Potential impact
Suggested fix (if available)

Known Vulnerabilities¶

Base Image Vulnerabilities¶

All known vulnerabilities originate from the Debian 13.4 (trixie) base image used by the official python:3.13-slim Docker image. No vulnerabilities exist in VPC Provisioner application code or Python dependencies.

HIGH Severity¶

CVE-2026-4046 (glibc iconv Denial of Service)¶

Status: fix_deferred
Severity: HIGH
Affected Component: glibc (libc-bin, libc6) 2.41-12+deb13u2
Source: Official Python Docker image (python:3.13-slim)

Description:
Denial of Service via the iconv() function when processing specific character sets. Present in the GNU C Library shipped with Debian 13.4.

Impact Assessment:

Upstream dependency vulnerability, not in VPC Provisioner application code
VPC Provisioner does not use iconv() for character set conversion
Difficult to exploit in containerized environments with no user-facing input parsing
Debian has deferred the fix to a future release

References:

CVE-2026-4046 Details

CVE-2025-69720 (ncurses Buffer Overflow)¶

Status: affected
Severity: HIGH
Affected Component: ncurses (libncursesw6, libtinfo6, ncurses-base, ncurses-bin) 6.5+20250216-2
Source: Official Python Docker image (python:3.13-slim)

Description:
Buffer overflow vulnerability in ncurses that may lead to arbitrary code execution. Present in the ncurses library shipped with Debian 13.4.

Impact Assessment:

Upstream dependency vulnerability, not in VPC Provisioner application code
VPC Provisioner does not use ncurses for terminal interaction
Container runs non-interactively via entrypoint script — no terminal UI
No fix available from Debian

References:

CVE-2025-69720 Details

CVE-2026-29111 (systemd Arbitrary Code Execution)¶

Status: affected
Severity: HIGH
Affected Component: systemd (libsystemd0, libudev1) 257.9-1~deb13u1
Source: Official Python Docker image (python:3.13-slim)

Description:
Arbitrary code execution or Denial of Service via spurious IPC in systemd. Present in the systemd libraries shipped with Debian 13.4.

Impact Assessment:

Upstream dependency vulnerability, not in VPC Provisioner application code
VPC Provisioner does not interact with systemd IPC mechanisms
Container does not run systemd — uses a simple entrypoint script
No fix available from Debian

References:

CVE-2026-29111 Details

MEDIUM Severity¶

CVE	Component	Version	Description
CVE-2026-4437	glibc (libc-bin, libc6)	2.41-12+deb13u2	Incorrect DNS response parsing via crafted DNS server response
CVE-2026-4438	glibc (libc-bin, libc6)	2.41-12+deb13u2	Invalid DNS hostname returned via gethostbyaddr functions
CVE-2026-4105	systemd (libsystemd0, libudev1)	257.9-1~deb13u1	Privilege escalation via improper access control in RegisterMachine D-Bus method
CVE-2026-27171	zlib (zlib1g)	1.3.dfsg+really1.3.1-1+b1	Denial of Service via infinite loop in CRC32 combine functions

Impact Assessment: All MEDIUM vulnerabilities are in base image system libraries. VPC Provisioner does not directly invoke the affected functions. No fixes are currently available from Debian.

LOW Severity¶

73 LOW-severity findings exist in the Debian 13.4 base image across packages including apt, bash, coreutils, openssl, perl, shadow-utils, sqlite, tar, and util-linux. These are long-standing issues with no fixes available from Debian. They are monitored and will be resolved when upstream patches are released.

Common Mitigations¶

The following mitigations apply to all base image vulnerabilities:

Using official Python Docker image from trusted source (Docker Hub)
Container runs as non-root user (vpcuser) with restricted permissions
No network services exposed by the container
Container filesystem is read-only except for mounted volumes
AWS credentials are mounted read-only at runtime
Container runs non-interactively — no shell access, no terminal UI
Multi-stage Docker build separates build dependencies from runtime

Customer Guidance:
When Amazon Inspector flags these vulnerabilities:

Acknowledge these are known base image vulnerabilities
Review this security disclosure for context
Implement additional security controls as needed (network isolation, IAM restrictions)
Monitor for updated VPC Provisioner releases with patched base image

Security Features¶

Container Security¶

Non-root user: Container runs as vpcuser (UID 1000)
Minimal base image: Using python:3.13-slim for reduced attack surface
Multi-stage build: Separates build dependencies from runtime
No hardcoded credentials: All credentials provided at runtime
Read-only mounts: AWS credentials mounted as read-only
Health checks: Container health monitoring enabled
OCI metadata: Full image labeling for tracking and compliance

Application Security¶

Input validation: All configuration inputs validated against JSON schemas
IAM least privilege: Minimal IAM permissions required
Cython compilation: Core modules compiled to .so files for code protection
License validation: AWS Marketplace license verification
Audit logging: All operations logged with timestamps
CloudFormation: Infrastructure as Code for reproducibility and audit trails

Network Security¶

No exposed ports: Container exposes no network services
VPC isolation: Provisions isolated VPCs with proper segmentation
Security groups: Implements least privilege network access
VPC Flow Logs: Enables network traffic monitoring
Private subnets: Supports private subnet configurations with NAT Gateway

Security Best Practices¶

For detailed security guidelines, see:

Security Guidelines
User Guide
IAM Permissions

Security Scanning¶

Pre-deployment Scanning¶

Run security scans before deploying:

# Scan Docker image for vulnerabilities
cd packages/vpc-provisioner-tool/docker
./scan-image.sh

Continuous Monitoring¶

Amazon Inspector: Scans container images in ECR
AWS Security Hub: Aggregates security findings
CloudTrail: Monitors API activity
CloudWatch: Monitors application logs and metrics

Compliance¶

Standards¶

AWS Well-Architected Framework - Security Pillar
CIS Docker Benchmark
NIST Cybersecurity Framework

Certifications¶

AWS Marketplace security requirements
Container security best practices
Infrastructure as Code security standards

Security Update Policy¶

Update Priority¶

Critical vulnerabilities: Patched within 24 hours
High vulnerabilities: Patched within 7 days
Medium vulnerabilities: Patched within 30 days
Low vulnerabilities: Patched in next regular release

Update Notification¶

Security updates are announced via:

Release notes (CHANGELOG.md)
Security advisories (this document)
AWS Marketplace product updates
Email notifications to registered customers

Incident Response¶

Response Process¶

Detection: Vulnerability identified via scanning or reporting
Assessment: Evaluate severity and impact
Containment: Implement temporary mitigations if needed
Remediation: Develop and test fix
Deployment: Release patched version
Communication: Notify customers and stakeholders
Review: Post-incident analysis and documentation

Contact Information¶

Security Team: security@axontechlabs.com
Emergency Response: Available 24/7 for critical issues
AWS Support: Enterprise Support for infrastructure issues

Version History¶

Version	Date	Changes
1.0.0	2025-01-31	Initial security policy
1.0.0	2025-01-31	Documented CVE-2026-0861 in base image
1.1.0	2026-03-31	Updated to Debian 13.4 (trixie) base image vulnerabilities

Additional Resources¶

Last Updated: 2026-03-31
Next Review: 2026-06-30