Every CVE Search/ Get API key

CVE-2018-15869

Recommended update for aws-cli, python-boto3, python-botocore, python-s3transfer

5.3 MediumFix available

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

1.80%Up 1.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

Record
CVE-2018-15869
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-732
Updated
2026-11-02
CVE List No score

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

Record
CVE-2018-15869
Updated
2026-11-02
EUVDEUVD-2018-7726 No score

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

Record
EUVD-2018-7726
Updated
2026-11-03
OSV 5.3

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

Record
CVE-2018-15869
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-15869 5.3

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

Record
DEBIAN-CVE-2018-15869
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2018-15869 5.3

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

Record
UBUNTU-CVE-2018-15869
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:10644-1 No score

aws-cli-1.20.7-2.2 on GA media

These are all security issues fixed in the aws-cli-1.20.7-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10644-1
Updated
2026-11-02
OSVSUSE-RU-2018:4074-1 No score

Recommended update for aws-cli, python-boto3, python-botocore, python-s3transfer

This update for aws-cli, python-boto3, python-botocore, python-s3transfer fixes the following issues:

aws-cli:

  • Update to version 1.16.61. (bsc#1088310)
  • Update to version 1.16.1 (bsc#1105988, bsc#1092493)
    • CVE-2018-15869: An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, might have unintentionally loaded an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.
  • Disable vendored versions of requests and six from botocore and use requests and six from the RPM packages.

python-botocore:

  • Update to version 1.10.40
    • For detailed changes, please refer to the changelog.
    • Remove the broken attempt to avoid using the bundeled requests module provided by the source (bsc#1088310)

python-boto3:

  • Version update to 1.9.57 (bsc#1118021, bsc#1118027)
    • For detailed changes, please refer to the changelog.

python-s3transfer:

  • Update to version 0.1.13
  • Make sure to really not use any bundles.
  • enhancement:max_bandwidth: Add ability to set maximum bandwidth consumption for streaming of S3 uploads and downloads.
Record
SUSE-RU-2018:4074-1
Updated
2026-11-02
OSVSUSE-SU-2020:0251-1 No score

Security update for aws-cli

This update for aws-cli to version 1.16.297 fixes the following issues:

Security issue fixed:

  • CVE-2018-15869: Fixed an permission handling issue where an unexpected AMI could potentially be used (bsc#1105988).

Non-security issues fixed:

  • Fixed an issue with the CLI client, where a ModuleNotFoundError was triggered (bsc#1092493).
Record
SUSE-SU-2020:0251-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
packer
Debian:12
 before 1.3.1+dfsg-1
1.3.1+dfsg-1
python-boto3
SUSE:Linux Enterprise Module for Basesystem 15
 before 1.9.57-3.5.1
1.9.57-3.5.1
python-botocore
SUSE:Linux Enterprise Module for Basesystem 15
 before 1.12.57-3.5.1
1.12.57-3.5.1
python-s3transfer
SUSE:Linux Enterprise Module for Basesystem 15
 before 0.1.13-3.3.6
0.1.13-3.3.6
python-boto3
SUSE:Linux Enterprise Module for Package Hub 15
 before 1.9.57-3.5.1
1.9.57-3.5.1
python-botocore
SUSE:Linux Enterprise Module for Package Hub 15
 before 1.12.57-3.5.1
1.12.57-3.5.1
python-s3transfer
SUSE:Linux Enterprise Module for Package Hub 15
 before 0.1.13-3.3.6
0.1.13-3.3.6
aws-cli
SUSE:Linux Enterprise Module for Public Cloud 15
 before 1.16.61-4.7.1
1.16.61-4.7.1
aws-cli
SUSE:HPE Helion OpenStack 8
 before 1.16.297-22.11.1
1.16.297-22.11.1
aws-cli
SUSE:OpenStack Cloud 8
 before 1.16.297-22.11.1
1.16.297-22.11.1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
aws-cli
SUSE:OpenStack Cloud Crowbar 8
 before 1.16.297-22.11.1
1.16.297-22.11.1
aws-cli
SUSE:Linux Enterprise Module for Public Cloud 12
 before 1.16.297-22.11.1
1.16.297-22.11.1
packer
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.0.2+dfsg-11.0.4+dfsg-11.0.4+dfsg-1ubuntu0.1
 None known
packer
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.3.4+dfsg-4
 None known
packer
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.6.6+ds1-21.6.6+ds1-41.6.6+ds1-4ubuntu0.22.04.11.6.6+ds1-4ubuntu0.22.04.21.6.6+ds1-4ubuntu0.22.04.31.6.6+ds1-4ubuntu0.22.04.3+esm11.6.6+ds1-4ubuntu0.22.04.3+esm2
 None known
awscli
Ubuntu:25.10
 All versions, plus listed versions
2.23.6-1
 None known
awscli
Ubuntu:26.10
 All versions, plus listed versions
2.31.35-12.34.56-12.36.17-1
 None known
awscli
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.23.6-12.31.35-1
 None known
aws-cli
openSUSE:Tumbleweed
 before 1.20.7-2.2
1.20.7-2.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-15869 is a medium vulnerability (CVSS 5.3) in Hashicorp Packer, published August 25, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.80%, the 78th percentile. Fixed in packer 1.3.1+dfsg-1.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open