Improper Source Software Validation in Amazon Web Services (AWS) CLI
CVE-2018-15869

5.3MEDIUM

Key Information:

Vendor

Hashicorp
Status
Packer
Vendor
CVE Published:
25 August 2018

What is CVE-2018-15869?

A flaw exists in the AWS CLI, where users who neglect to specify the --owners flag while describing images may inadvertently allow the loading of unverified and potentially harmful Amazon Machine Images (AMIs). This oversight can lead to the risk of utilizing undesired images from the public community AMI catalog, compromising the security integrity of deployments and posing threats to the user's environment.

References

http://www.securityfocus.com/bid/105172
vdb-entryx_refsource_BID
https://github.com/hashicorp/packer/issues/6584
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.