{"schemaVersion":3,"id":"CVE-2018-15869","aliases":["SUSE-RU-2018:4074-1","SUSE-SU-2020:0251-1","UBUNTU-CVE-2018-15869","DEBIAN-CVE-2018-15869","openSUSE-SU-2024:10644-1"],"status":"published","duplicateOf":null,"title":null,"description":"An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.","dates":{"published":"2018-08-25T00:00:00.000Z","modified":"2024-08-05T10:10:05.047Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":5.3,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Debian","score":5.3,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true}]},"epss":{"probability":0.01801,"percentile":0.78208,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01801},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0206,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01801,"percentile":0.78208}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0206,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01801,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01801,"percentile":0.78208}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-732","name":"Incorrect Permission Assignment for Critical Resource","description":"The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/732.html"}],"affected":[{"vendor":"debian","product":"packer","name":"packer","label":"packer","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/packer","purlType":"deb","versions":[{"text":"< 1.3.1+dfsg-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.1+dfsg-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"awscli","name":"awscli","label":"awscli","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/awscli","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"packer","name":"packer","label":"packer","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/packer","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"hashicorp","product":"packer","name":"packer","label":"packer","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.0","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"hashicorp-packer","label":"Hashicorp Packer","category":"server-app"}},"hubHref":"/vendor/hashicorp/packer"},{"vendor":"opensuse","product":"aws-cli&distro=openSUSE Tumbleweed","name":"aws-cli","label":"aws-cli&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/aws-cli&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 1.20.7-2.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.20.7-2.2","eol":null,"hubHref":null},{"vendor":"suse","product":"aws-cli&distro=HPE Helion OpenStack 8","name":"aws-cli","label":"aws-cli&distro=HPE Helion OpenStack 8","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/aws-cli&distro=HPE Helion OpenStack 8","purlType":"rpm","versions":[{"text":"< 1.16.297-22.11.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.297-22.11.1","eol":null,"hubHref":null},{"vendor":"suse","product":"aws-cli&distro=SUSE Linux Enterprise Module for Public Cloud 12","name":"aws-cli","label":"aws-cli&distro=SUSE Linux Enterprise Module for Public Cloud 12","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/aws-cli&distro=SUSE Linux Enterprise Module for Public Cloud 12","purlType":"rpm","versions":[{"text":"< 1.16.297-22.11.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.297-22.11.1","eol":null,"hubHref":null},{"vendor":"suse","product":"aws-cli&distro=SUSE Linux Enterprise Module for Public Cloud 15","name":"aws-cli","label":"aws-cli&distro=SUSE Linux Enterprise Module for Public Cloud 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/aws-cli&distro=SUSE Linux Enterprise Module for Public Cloud 15","purlType":"rpm","versions":[{"text":"< 1.16.61-4.7.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.61-4.7.1","eol":null,"hubHref":null},{"vendor":"suse","product":"aws-cli&distro=SUSE OpenStack Cloud 8","name":"aws-cli","label":"aws-cli&distro=SUSE OpenStack Cloud 8","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/aws-cli&distro=SUSE OpenStack Cloud 8","purlType":"rpm","versions":[{"text":"< 1.16.297-22.11.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.297-22.11.1","eol":null,"hubHref":null},{"vendor":"suse","product":"aws-cli&distro=SUSE OpenStack Cloud Crowbar 8","name":"aws-cli","label":"aws-cli&distro=SUSE OpenStack Cloud Crowbar 8","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/aws-cli&distro=SUSE OpenStack Cloud Crowbar 8","purlType":"rpm","versions":[{"text":"< 1.16.297-22.11.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.297-22.11.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-boto3&distro=SUSE Linux Enterprise Module for Basesystem 15","name":"python-boto3","label":"python-boto3&distro=SUSE Linux Enterprise Module for Basesystem 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-boto3&distro=SUSE Linux Enterprise Module for Basesystem 15","purlType":"rpm","versions":[{"text":"< 1.9.57-3.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.57-3.5.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-boto3&distro=SUSE Linux Enterprise Module for Package Hub 15","name":"python-boto3","label":"python-boto3&distro=SUSE Linux Enterprise Module for Package Hub 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-boto3&distro=SUSE Linux Enterprise Module for Package Hub 15","purlType":"rpm","versions":[{"text":"< 1.9.57-3.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.57-3.5.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-botocore&distro=SUSE Linux Enterprise Module for Basesystem 15","name":"python-botocore","label":"python-botocore&distro=SUSE Linux Enterprise Module for Basesystem 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-botocore&distro=SUSE Linux Enterprise Module for Basesystem 15","purlType":"rpm","versions":[{"text":"< 1.12.57-3.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.12.57-3.5.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-botocore&distro=SUSE Linux Enterprise Module for Package Hub 15","name":"python-botocore","label":"python-botocore&distro=SUSE Linux Enterprise Module for Package Hub 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-botocore&distro=SUSE Linux Enterprise Module for Package Hub 15","purlType":"rpm","versions":[{"text":"< 1.12.57-3.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.12.57-3.5.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-s3transfer&distro=SUSE Linux Enterprise Module for Basesystem 15","name":"python-s3transfer","label":"python-s3transfer&distro=SUSE Linux Enterprise Module for Basesystem 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-s3transfer&distro=SUSE Linux Enterprise Module for Basesystem 15","purlType":"rpm","versions":[{"text":"< 0.1.13-3.3.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.1.13-3.3.6","eol":null,"hubHref":null},{"vendor":"suse","product":"python-s3transfer&distro=SUSE Linux Enterprise Module for Package Hub 15","name":"python-s3transfer","label":"python-s3transfer&distro=SUSE Linux Enterprise Module for Package Hub 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-s3transfer&distro=SUSE Linux Enterprise Module for Package Hub 15","purlType":"rpm","versions":[{"text":"< 0.1.13-3.3.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.1.13-3.3.6","eol":null,"hubHref":null}],"affectedCount":16,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/105172","label":"www.securityfocus.com/bid/105172","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://github.com/hashicorp/packer/issues/6584","label":"github.com/hashicorp/packer/issues/6584","hostname":"github.com","tags":["X Refsource MISC","Third Party Advisory","REPORT"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20184074-1/","label":"www.suse.com/support/update/announcement//suse-ru-20184074-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1088310","label":"bugzilla.suse.com/1088310","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1092493","label":"bugzilla.suse.com/1092493","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1098125","label":"bugzilla.suse.com/1098125","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1105988","label":"bugzilla.suse.com/1105988","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1118021","label":"bugzilla.suse.com/1118021","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1118027","label":"bugzilla.suse.com/1118027","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15869","label":"www.suse.com/security/cve/CVE-2018-15869","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200251-1/","label":"www.suse.com/support/update/announcement/2020/suse-su-20200251-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1118024","label":"bugzilla.suse.com/1118024","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1118099","label":"bugzilla.suse.com/1118099","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-15869","label":"ubuntu.com/security/CVE-2018-15869","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://github.com/aws/aws-cli/issues/3629","label":"github.com/aws/aws-cli/issues/3629","hostname":"github.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-15869","label":"www.cve.org/CVERecord?id=CVE-2018-15869","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-15869","label":"security-tracker.debian.org/tracker/CVE-2018-15869","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-08-25T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T10:10:05.047Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":22,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T23:01:56.326Z","stale":false,"partial":false}}