Medium severity · published Aug 25, 2018
CVE-2018-15869
An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS…
5.3
CVSS
1.8%
EPSS
No
On KEV
Description
An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Packer · Hashicorp
before 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-15869
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-15869
Third Party Advisory
http://www.securityfocus.com/bid/105172
Third Party Advisory
https://github.com/hashicorp/packer/issues/6584
More from Packer
7.1
CVE-2026-19589
Packer vulnerable to arbitrary file write via crafted plugin archive during installation