CVE-2018-15869: Medium severity hashicorp packer vulnerability
An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15869?
CVE-2018-15869 is considered a moderate severity vulnerability due to the potential risk of deploying malicious Amazon Machine Images.
How do I fix CVE-2018-15869?
To mitigate CVE-2018-15869, ensure that you always specify the --owners flag when using the AWS CLI to describe images.
What impact does CVE-2018-15869 have on AWS environments?
CVE-2018-15869 can potentially lead to the deployment of unauthorized and harmful AMIs, affecting the security of your AWS environment.
Who is affected by CVE-2018-15869?
Developers and users of HashiCorp Packer prior to version 1.3.0 who utilize the AWS CLI without proper flags are at risk from CVE-2018-15869.
Is it safe to use HashiCorp Packer with AWS if CVE-2018-15869 is present?
Using HashiCorp Packer with AWS without mitigation for CVE-2018-15869 can expose your environment to risks from malicious AMIs.