CVE-2025-9039 (CNNVD-202508-1718)
中文标题:
Amazon ECS Container Agent 安全漏洞
英文标题:
Information Disclosure in Amazon ECS Container Agent
漏洞描述
中文描述:
Amazon ECS Container Agent是Amazon Web Services开源的一个弹性容器服务代理软件。 Amazon ECS Container Agent存在安全漏洞，该漏洞源于在某些条件下，内省服务器可以被同一安全组中的其他实例访问。
英文描述:
We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that include the port where the server is hosted. This issue does not affect instances where the option to allow off-host access to the introspection server is set to 'false'. This issue has been addressed in ECS agent version 1.97.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. If customers cannot update to the latest AMI, they can modify the Amazon EC2 security groups to restrict incoming access to the introspection server port (51678).
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Amazon | ECS | - | < 1.97.1 | - |
cpe:2.3:a:amazon:ecs:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-9039 |
2025-11-11 15:23:37 | 2025-11-11 07:40:53 |
| NVD | nvd_CVE-2025-9039 |
2025-11-11 15:00:59 | 2025-11-11 07:48:40 |
| CNNVD | cnnvd_CNNVD-202508-1718 |
2025-11-11 15:12:53 | 2025-11-11 08:00:05 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202508-1718
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']