Packer
Monthly
Path traversal (CWE-22) in HashiCorp Packer's third-party plugin installer through version 1.15.4 permits a crafted plugin archive to write files outside the intended extraction directory, enabling code execution on the host. Users who install plugins from malicious or compromised sources trigger the vulnerability through the normal `packer plugins install` workflow. No public exploit code has been identified at time of analysis, and a vendor-released fix is available in Packer 1.16.0.
An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path traversal (CWE-22) in HashiCorp Packer's third-party plugin installer through version 1.15.4 permits a crafted plugin archive to write files outside the intended extraction directory, enabling code execution on the host. Users who install plugins from malicious or compromised sources trigger the vulnerability through the normal `packer plugins install` workflow. No public exploit code has been identified at time of analysis, and a vendor-released fix is available in Packer 1.16.0.
An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.