CVE-2018-15869 An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security bes...
MediumCVSS 5.3
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/packer(Debian:12) | < 1.3.1+dfsg-1 | 1.3.1+dfsg-1 |
| hashicorp Packer | < 1.3.0 | 1.3.0 |
| ubuntu/awscli(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/awscli(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/packer(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-15869 vendor-advisory
- 105172 third-party-advisory vdb-entry
- github.com third-party-advisory
- bugs.debian.org issue-tracking