CVE-2022-3697

2022-10-2800:00:00

ubuntu.com

ansible

amazon aws

flaw

password leaking

logs

security vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

52.5%

JSON

A flaw was found in Ansible in the amazon.aws collection when using the
tower_callback parameter from the amazon.aws.ec2_instance module. This flaw
allows an attacker to take advantage of this issue as the module is
handling the parameter insecurely, leading to the password leaking in the
logs.

Notes

Author	Note
sbeattie	core ansible binaries were split into ansible-base, which got renamed to ansible-core

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchansible< 2.5.1+dfsg-1ubuntu0.1+esm2UNKNOWN
ubuntu20.04noarchansible< 2.9.6+dfsg-1ubuntu0.1~esm2UNKNOWN
ubuntu22.04noarchansible< 2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4UNKNOWN
ubuntu22.04noarchansible-core< anyUNKNOWN
ubuntu24.04noarchansible-core< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	ansible	< 2.5.1+dfsg-1ubuntu0.1+esm2	UNKNOWN
ubuntu	20.04	noarch	ansible	< 2.9.6+dfsg-1ubuntu0.1~esm2	UNKNOWN
ubuntu	22.04	noarch	ansible	< 2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4	UNKNOWN
ubuntu	22.04	noarch	ansible-core	< any	UNKNOWN
ubuntu	24.04	noarch	ansible-core	< any	UNKNOWN