CVE-2018-15869

Name	CVE-2018-15869
Description	An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	907298

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
packer (PTS)	stretch (security), stretch (lts), stretch	0.10.2+dfsg-6+deb9u1	fixed
	buster (security), buster, buster (lts)	1.3.4+dfsg-4+deb10u1	fixed
	bullseye	1.6.6+ds1-2	fixed
	bookworm	1.6.6+ds2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
packer	source	stretch	(not affected)
packer	source	(unstable)	1.3.1+dfsg-1	low		907298

Notes

[stretch] - packer <not-affected> (Vulnerable code added later)
https://github.com/hashicorp/packer/issues/6584
https://github.com/aws/aws-cli/issues/3629