Lucene search

K
friendsofphpOpenJS FoundationFRIENDSOFPHP:AWS
HistoryJul 24, 2015 - 12:41 a.m.

Security Misconfiguration Vulnerability in the AWS SDK for PHP

2015-07-2400:41:41
OpenJS Foundation
github.com
12

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.7%

SECURITY FIX: This release addresses a security issue associated with CVE-2015-5723, specifically, fixes improper default directory umask behavior that could potentially allow unauthorized modifications of PHP code. (Thanks to @ryan-lane for the initial report.) Aws\Ec2 - Added support for SpotFleetLaunchSpecification. Aws\Emr - Added support for Amazon EMR release 4.0.0, which includes a new application installation and configuration experience, upgraded versions of Hadoop, Hive, and Spark, and now uses open source standards for ports and paths. To specify an Amazon EMR release, use the release label parameter (AMI versions 3.x and 2.x can still be specified with the AMI version parameter). Aws\Glacier - Added support for the InitiateVaultLock, GetVaultLock, AbortVaultLock, and CompleteVaultLock API operations. Fixed a memory leak that occurred when clients were created and never used. Updated JsonCompiler by addressing a potential race condition and ensuring that caches are invalidated when upgrading to a new version of the SDK. Updated protocol and acceptance tests.

CPENameOperatorVersion
aws/aws-sdk-phplt3.2.1

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.7%