PT-2026-67492

Name of the Vulnerable Software and Affected Versions Amazon AWS CLI versions prior to 1.45.28 Amazon AWS CLI v2 versions prior to 2.35.3 Description Key exchange without entity authentication in the EMR SSH helper commands allows man-in-the-middle attackers to intercept SSH sessions and file...

CVE-2025-8904: Storing Passwords in a Recoverable Format

Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher privileges. Users are advised to upgrade to Amazon EMR versio...

Amazon EMR 安全漏洞

Amazon EMR is a hosted clustering platform from Amazon.com, USA. A security vulnerability exists in Amazon EMR that stems from a keytab file stored in the /tmp/ directory that could lead to elevation of privilege...

Security Misconfiguration Vulnerability in the AWS SDK for PHP

SECURITY FIX: This release addresses a security issue associated with CVE-2015-5723, specifically, fixes improper default directory umask behavior that could potentially allow unauthorized modifications of PHP code. Thanks to @ryan-lane for the initial report. Aws\Ec2 - Added support for...