{"id":"CVE-2018-15869","aliases":["DEBIAN-CVE-2018-15869","EUVD-2018-7726","SUSE-RU-2018:4074-1","SUSE-SU-2020:0251-1","UBUNTU-CVE-2018-15869","openSUSE-SU-2024:10644-1"],"status":"published","title":"Recommended update for aws-cli, python-boto3, python-botocore, python-s3transfer","description":"An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01801,"percentile":0.78635,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2018-08-25T00:00:00Z","modified":"2026-10-23T18:03:00Z","fixes":[{"ecosystem":"Debian:12","package":"packer","fixed_in":["1.3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-boto3","fixed_in":["1.9.57-3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-botocore","fixed_in":["1.12.57-3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-s3transfer","fixed_in":["0.1.13-3.3.6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"python-boto3","fixed_in":["1.9.57-3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"python-botocore","fixed_in":["1.12.57-3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"python-s3transfer","fixed_in":["0.1.13-3.3.6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15","package":"aws-cli","fixed_in":["1.16.61-4.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"aws-cli","fixed_in":["1.16.297-22.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"aws-cli","fixed_in":["1.16.297-22.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"aws-cli","fixed_in":["1.16.297-22.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"aws-cli","fixed_in":["1.16.297-22.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"aws-cli","fixed_in":["1.20.7-2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-boto3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.57-3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-botocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.57-3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-s3transfer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.13-3.3.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"python-boto3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.57-3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"python-botocore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.57-3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"python-s3transfer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.13-3.3.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15","package":"aws-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.61-4.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"aws-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.297-22.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"aws-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.297-22.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"aws-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.297-22.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"aws-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.297-22.11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2+dfsg-1","1.0.4+dfsg-1","1.0.4+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.6+ds1-2","1.6.6+ds1-4","1.6.6+ds1-4ubuntu0.22.04.1","1.6.6+ds1-4ubuntu0.22.04.2","1.6.6+ds1-4ubuntu0.22.04.3","1.6.6+ds1-4ubuntu0.22.04.3+esm1","1.6.6+ds1-4ubuntu0.22.04.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"awscli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"awscli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.31.35-1","2.34.56-1","2.36.17-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"awscli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.6-1","2.31.35-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"aws-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.7-2.2"}]}]}],"products":[{"vendor":"hashicorp","product":"packer"}],"references":[{"url":"http://www.securityfocus.com/bid/105172","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/hashicorp/packer/issues/6584","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-15869","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20184074-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1088310","tags":["report"]},{"url":"https://bugzilla.suse.com/1092493","tags":["report"]},{"url":"https://bugzilla.suse.com/1098125","tags":["report"]},{"url":"https://bugzilla.suse.com/1105988","tags":["report"]},{"url":"https://bugzilla.suse.com/1118021","tags":["report"]},{"url":"https://bugzilla.suse.com/1118027","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15869","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200251-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118024","tags":["report"]},{"url":"https://bugzilla.suse.com/1118099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15869","tags":["report"]},{"url":"https://github.com/aws/aws-cli/issues/3629","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-15869","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-15869","description":"An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.","status":"published","published":"2018-08-25T00:00:00Z","modified":"2024-08-05T10:10:05.047Z","updated_at":"2026-11-02T14:35:03.288698Z"}],"euvd":[{"id":"EUVD-2018-7726","description":"An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.","status":"published","published":"2018-08-25T00:00:00Z","modified":"2024-08-05T10:10:05Z","updated_at":"2026-11-03T02:39:43.665553Z"}],"nvd":[{"id":"CVE-2018-15869","description":"An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.","status":"published","published":"2018-08-25T00:29:00.227Z","modified":"2026-06-17T01:43:14.28Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:04:36.842579Z"}],"osv":[{"id":"CVE-2018-15869","description":"An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.","status":"published","published":"2018-08-25T00:29:00.227Z","modified":"2026-10-20T10:50:22.851896402Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-15869","description":"An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.","status":"published","published":"2018-08-25T00:29:00.227Z","modified":"2026-10-23T18:03:00.693263312Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-15869","description":"An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.","status":"published","published":"2018-08-25T00:29:00Z","modified":"2026-10-17T12:55:02.094569545Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"openSUSE-SU-2024:10644-1","title":"aws-cli-1.20.7-2.2 on GA media","description":"These are all security issues fixed in the aws-cli-1.20.7-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:29.110236Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-RU-2018:4074-1","title":"Recommended update for aws-cli, python-boto3, python-botocore, python-s3transfer","description":"This update for aws-cli, python-boto3, python-botocore, python-s3transfer fixes the following issues:\n\naws-cli:\n\n\n- Update to version 1.16.61. (bsc#1088310)\n  + For detailed changes see\n    https://github.com/aws/aws-cli/blob/1.16.1/CHANGELOG.rst\n- Update to version 1.16.1 (bsc#1105988, bsc#1092493)\n  + CVE-2018-15869: An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, might have unintentionally loaded an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.\n- Disable vendored versions of requests and six from botocore and use requests and six\n  from the RPM packages.\n\npython-botocore:\n\n- Update to version 1.10.40\n  + For detailed changes, please refer to the changelog.\n  + Remove the broken attempt to avoid using the bundeled\n    requests module provided by the source (bsc#1088310)\n\npython-boto3:\n\n- Version update to 1.9.57 (bsc#1118021, bsc#1118027)\n  + For detailed changes, please refer to the changelog.\n\npython-s3transfer:\n\n- Update to version 0.1.13\n- Make sure to really not use any bundles.\n- enhancement:max_bandwidth: Add ability to set maximum bandwidth consumption for streaming of S3 uploads and downloads.\n","status":"published","published":"2018-12-11T20:46:06Z","modified":"2026-02-04T03:00:50.059204Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2020:0251-1","title":"Security update for aws-cli","description":"This update for aws-cli to version 1.16.297 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-15869: Fixed an permission handling issue where an unexpected AMI could potentially be used (bsc#1105988).\n\nNon-security issues fixed:\n\n- Fixed an issue with the CLI client, where a ModuleNotFoundError was triggered (bsc#1092493).\n","status":"published","published":"2020-01-28T15:34:46Z","modified":"2026-02-04T03:39:20.730896Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}