PT-2018-13255 · Amazon+1 · Aws Cli+3

Swampdragon · Published 2018-08-25 · Updated 2024-06-15 · CVE-2018-15869

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Amazon Web Services (AWS) (affected versions not specified)

Description The issue arises when an AWS developer fails to specify the --owners flag while describing images via AWS CLI, which leads to not properly validating the source software according to AWS recommended security best practices. This oversight may cause the unintentional loading of an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

Recommendations For AWS CLI users, as a temporary workaround, consider specifying the --owners flag when describing images to ensure proper validation of source software. Restrict access to the public community AMI catalog to minimize the risk of exploitation. Avoid loading AMIs from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-15869

OPENSUSE-SU-2024:10644-1

SUSE-RU-2018:4074-1

SUSE-SU-2020:0251-1

SUSE-SU-2020_0251-1

Affected Products

Aws

Aws Cli

Amazon Machine Image

Suse

References · 27

• 🔥 https://github.com/hashicorp/packer/issues/6584 · Exploit
• https://ubuntu.com/security/CVE-2018-15869 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-15869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15869 · Security Note
• https://osv.dev/vulnerability/SUSE-RU-2018:4074-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-15869 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-15869 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-15869 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10644-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0251-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-15869 · Vendor Advisory
• https://github.com/aws/aws-cli/issues/3629 · Note
• https://bugzilla.suse.com/1098125 · Note
• https://suse.com/security/cve/CVE-2018-15869.html · Note
• https://suse.com/support/update/announcement/2020/suse-su-20200251-1 · Note