CVE-2017-9450

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-30 · updated 2026-06-17
Weakness: CWE-269

Description

The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap) before 1.4-19.10 allows local users to execute arbitrary code with root privileges by leveraging the ability to create files in an unspecified directory.

Affected products

Amazon Web Services Cloudformation Bootstrap: before 1.4-19.10 — fixed in 1.4-19.10

How to fix

Upgrade to a fixed version: Amazon Web Services Cloudformation Bootstrap 1.4-19.10. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/99972
https://alas.aws.amazon.com/ALAS-2017-861.html
https://sintonen.fi/advisories/aws-cfn-bootstrap-local-code-execution-as-root.txt
http://www.securityfocus.com/bid/99972
https://alas.aws.amazon.com/ALAS-2017-861.html
https://sintonen.fi/advisories/aws-cfn-bootstrap-local-code-execution-as-root.txt

Get alerted when CVE-2017-9450 or the next vulnerability affects your stack