CVE-2018-15869

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-25 · updated 2026-06-17
Weakness: CWE-732

Description

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

Affected products

HashiCorp Packer: before 1.3.0 — fixed in 1.3.0

How to fix

Upgrade to a fixed version: HashiCorp Packer 1.3.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/105172
https://github.com/hashicorp/packer/issues/6584
http://www.securityfocus.com/bid/105172
https://github.com/hashicorp/packer/issues/6584

Get alerted when CVE-2018-15869 or the next vulnerability affects your stack