Security update for aws-cli SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0251-1 Final 1 1 2020-01-28T15:34:46Z current 2020-01-28T15:34:46Z 2020-01-28T15:34:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for aws-cli This update for aws-cli to version 1.16.297 fixes the following issues: Security issue fixed: - CVE-2018-15869: Fixed an permission handling issue where an unexpected AMI could potentially be used (bsc#1105988). Non-security issues fixed: - Fixed an issue with the CLI client, where a ModuleNotFoundError was triggered (bsc#1092493). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2020-251,Image SLES12-SP4-EC2-HVM-BYOS-2020-251,Image SLES12-SP4-SAP-EC2-HVM-2020-251,Image SLES12-SP4-SAP-EC2-HVM-BYOS-2020-251,Image SLES12-SP5-EC2-BYOS-2020-251,Image SLES12-SP5-EC2-ECS-On-Demand-2020-251,Image SLES12-SP5-EC2-On-Demand-2020-251,Image SLES12-SP5-EC2-SAP-BYOS-2020-251,Image SLES12-SP5-EC2-SAP-On-Demand-2020-251,SUSE-2020-251,SUSE-OpenStack-Cloud-8-2020-251,SUSE-OpenStack-Cloud-Crowbar-8-2020-251,SUSE-SLE-Module-Public-Cloud-12-2020-251 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200251-1/ Link for SUSE-SU-2020:0251-1 https://lists.suse.com/pipermail/sle-security-updates/2020-January/006409.html E-Mail link for SUSE-SU-2020:0251-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1092493 SUSE Bug 1092493 https://bugzilla.suse.com/1105988 SUSE Bug 1105988 https://bugzilla.suse.com/1118021 SUSE Bug 1118021 https://bugzilla.suse.com/1118024 SUSE Bug 1118024 https://bugzilla.suse.com/1118099 SUSE Bug 1118099 https://www.suse.com/security/cve/CVE-2018-15869/ SUSE CVE CVE-2018-15869 page HPE Helion OpenStack 8 Image SLES12-SP4-EC2-HVM-BYOS Image SLES12-SP4-SAP-EC2-HVM Image SLES12-SP4-SAP-EC2-HVM-BYOS Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand SUSE Linux Enterprise Module for Public Cloud 12 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 aws-cli-1.16.297-22.11.1 aws-cli-1.16.297-22.11.1 as a component of HPE Helion OpenStack 8 aws-cli-1.16.297-22.11.1 as a component of Image SLES12-SP4-EC2-HVM-BYOS aws-cli-1.16.297-22.11.1 as a component of Image SLES12-SP4-SAP-EC2-HVM aws-cli-1.16.297-22.11.1 as a component of Image SLES12-SP4-SAP-EC2-HVM-BYOS aws-cli-1.16.297-22.11.1 as a component of Image SLES12-SP5-EC2-BYOS aws-cli-1.16.297-22.11.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand aws-cli-1.16.297-22.11.1 as a component of Image SLES12-SP5-EC2-On-Demand aws-cli-1.16.297-22.11.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS aws-cli-1.16.297-22.11.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand aws-cli-1.16.297-22.11.1 as a component of SUSE Linux Enterprise Module for Public Cloud 12 aws-cli-1.16.297-22.11.1 as a component of SUSE OpenStack Cloud 8 aws-cli-1.16.297-22.11.1 as a component of SUSE OpenStack Cloud Crowbar 8 An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog. CVE-2018-15869 HPE Helion OpenStack 8:aws-cli-1.16.297-22.11.1 Image SLES12-SP4-EC2-HVM-BYOS:aws-cli-1.16.297-22.11.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:aws-cli-1.16.297-22.11.1 Image SLES12-SP4-SAP-EC2-HVM:aws-cli-1.16.297-22.11.1 Image SLES12-SP5-EC2-BYOS:aws-cli-1.16.297-22.11.1 Image SLES12-SP5-EC2-ECS-On-Demand:aws-cli-1.16.297-22.11.1 Image SLES12-SP5-EC2-On-Demand:aws-cli-1.16.297-22.11.1 Image SLES12-SP5-EC2-SAP-BYOS:aws-cli-1.16.297-22.11.1 Image SLES12-SP5-EC2-SAP-On-Demand:aws-cli-1.16.297-22.11.1 SUSE Linux Enterprise Module for Public Cloud 12:aws-cli-1.16.297-22.11.1 SUSE OpenStack Cloud 8:aws-cli-1.16.297-22.11.1 SUSE OpenStack Cloud Crowbar 8:aws-cli-1.16.297-22.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200251-1/ https://www.suse.com/security/cve/CVE-2018-15869.html CVE-2018-15869 https://bugzilla.suse.com/1105988 SUSE Bug 1105988