CVE catalog

CVE-2018-15869

packer: CVE-2018-15869

[CVE catalog]

Severity
High · CVSS 8.6CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.80% · Oct 25, 2026

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpackerbookworm1.6.6+ds2-1fixed
Opensuseaws-clitumbleweed1.20.7-2.2fixed
Suseaws-clihpe helion openstack 81.16.297-22.11.1fixed
Suseaws-cliopenstack cloud 81.16.297-22.11.1fixed
Suseaws-cliopenstack cloud crowbar 81.16.297-22.11.1fixed
Suseaws-clilinux enterprise module for public cloud 121.16.297-22.11.1fixed
Susepython-boto3linux enterprise module for basesystem 151.9.57-3.5.1fixed
Susepython-botocorelinux enterprise module for basesystem 151.12.57-3.5.1fixed
Susepython-s3transferlinux enterprise module for basesystem 150.1.13-3.3.6fixed
Susepython-boto3linux enterprise module for package hub 151.9.57-3.5.1fixed
Susepython-botocorelinux enterprise module for package hub 151.12.57-3.5.1fixed
Susepython-s3transferlinux enterprise module for package hub 150.1.13-3.3.6fixed
Suseaws-clilinux enterprise module for public cloud 151.16.61-4.7.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpackersourcebookworm1.3.1+dfsg-1lowNot reported[907298]
Opensuseaws-clirpmtumbleweed1.20.7-2.2Not reportedOPENSUSE-SU-2024:10644-1Not reported
Suseaws-clirpmhpe helion openstack 81.16.297-22.11.1Not reportedSUSE-SU-2020:0251-1Not reported
Suseaws-clirpmopenstack cloud 81.16.297-22.11.1Not reportedSUSE-SU-2020:0251-1Not reported
Suseaws-clirpmopenstack cloud crowbar 81.16.297-22.11.1Not reportedSUSE-SU-2020:0251-1Not reported
Suseaws-clirpmlinux enterprise module for public cloud 121.16.297-22.11.1Not reportedSUSE-SU-2020:0251-1Not reported
Susepython-boto3rpmlinux enterprise module for basesystem 151.9.57-3.5.1Not reportedSUSE-RU-2018:4074-1Not reported
Susepython-botocorerpmlinux enterprise module for basesystem 151.12.57-3.5.1Not reportedSUSE-RU-2018:4074-1Not reported
Susepython-s3transferrpmlinux enterprise module for basesystem 150.1.13-3.3.6Not reportedSUSE-RU-2018:4074-1Not reported
Susepython-boto3rpmlinux enterprise module for package hub 151.9.57-3.5.1Not reportedSUSE-RU-2018:4074-1Not reported
Susepython-botocorerpmlinux enterprise module for package hub 151.12.57-3.5.1Not reportedSUSE-RU-2018:4074-1Not reported
Susepython-s3transferrpmlinux enterprise module for package hub 150.1.13-3.3.6Not reportedSUSE-RU-2018:4074-1Not reported
Suseaws-clirpmlinux enterprise module for public cloud 151.16.61-4.7.1Not reportedSUSE-RU-2018:4074-1Not reported

[Debian bug #907298]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [packer]Fixed

    Source package: [packer]

    Details (2)

    • 1.6.6+ds2-1+b1 · amd64 · bookworm

      Fixed · Fixed: 1.3.1+dfsg-1

      dsa · packer · debian · bookworm; dsa · packer · debian · 12

    • 1.6.6+ds2-1+b1 · arm64 · bookworm

      Fixed · Fixed: 1.3.1+dfsg-1

      dsa · packer · debian · bookworm; dsa · packer · debian · 12

[openSUSE Tumbleweed]

  • [aws-cli]Fixed

    Source package: [aws-cli]

    Details (1)

    • 1.45.64-1.1 · noarch · tumbleweed

      Fixed · Fixed: 1.20.7-2.2

      dsa · aws-cli · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]