AWS res high security documentation change
Summary
Added March 2026 release notes documenting security fixes for privilege escalation, remote code execution, and instance profile ARN issues, along with other enhancements and bug fixes
Security assessment
This change explicitly documents three security vulnerabilities that were fixed: 1) privilege escalation in FileBrowser component, 2) cross-user remote code execution via session name injection, and 3) improper use of external instance profile ARN when creating sessions. These are serious security issues with clear security implications including privilege escalation and remote code execution.
Diff
diff --git a/res/latest/ug/revisions.md b/res/latest/ug/revisions.md index dcab57221..2b2c923b2 100644 --- a//res/latest/ug/revisions.md +++ b//res/latest/ug/revisions.md @@ -10,0 +11,27 @@ Date | Change +March 2026 | + + * Release version 2026.03 Security fixes + * Fixed a privilege escalation vulnerability in the FileBrowser component. + * Fixed a cross-user remote code execution vulnerability via session name injection. + * Fixed an issue where an external instance profile ARN could be used when creating a session. +Enhancements + * Support for multiple volumes from a single ONTAP filesystem. + * Allow users to reset their session schedule to the system default. + * Allow administrators to restart errored VDIs from the Sessions page. + * Allow administrators to set instance type/family when registering a software stack. + * Allow administrators to configure DCV token expiration time via the RES portal. + * Allow administrators to add custom links to the web portal login page. + * Added configurable DCV session validation thresholds to support environments with longer bootstrap times. +Changes + * Continued migration of VDC-related APIs from the VDC EC2 host to the backend Lambda. + * Upgraded Python to 3.12+ on infrastructure and VDI hosts. + * Removed AL2 and RHEL8 from default software stacks. Existing AL2 and RHEL8 software stacks in deployed environments are unaffected but will no longer be included as defaults for new environments. + * Removed unnecessary RES_Interface shortcut from VDI desktops. +Bug fixes + * Fixed Sessions filter field. + * Fixed Ubuntu 24.04 bootstrap failure caused by systemd service restart. + * Fixed project deletion/creation when deploying with IAM resource prefix. + * Fixed failure to mount Lustre file system on RHEL9/Rocky9 VDIs. + * Fixed date range filter for list_sessions and list_shared_permissions. + + @@ -38,3 +65,14 @@ September 2025 | - * Changes - * Bug Fixes - * + * Region support expansion for ap-northeast-3, ap-southeast-3, me-central-1, and sa-east-1. + * Deletion of computer account from AD domain on VDI termination. + * Systems Manager Parameter Alias support for AMI IDs to simplify the management of project-specific images. + * Integration with pre-existing Amazon Cognito pool for streamlined authentication setup during deployment. + * Customization of CIDR ranges in the CloudFormation external resources template during deployment for enhanced network planning and integration with existing resources. + * Addition of AD email sync functionality after initialization. + * Support for Amazon EC2 g6f instances. +Changes + * Moving infrastructure deployment out of ECS installer task to simplify installation process. +Bug Fixes + * Resolved persistent instance resume failures. + * Resolved users being able to see other users desktop sessions. + * Resolved IAM user role name uniqueness issue in multi-region single account deployments. + @@ -114 +152 @@ October 2024 | - * [Virtual desktop interface autostop](./virtual-desktops-autostop.html). + * [Virtual desktop infrastructure autostop](./virtual-desktops-autostop.html).