GitHub Advisoryadvisory · PyPI

GHSA-cpx3-93w7-457x Ansible leaks password to logs

HIGH Published 2022-10-28 Modified 2023-08-31 Official page ↗
Aliases
CVE-2022-3697
Ecosystem
PyPI
Packages
ansible
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-233
Reviewed
2023-01-24

Affected packages

• PyPI ansible: >= 2.5.0, < 7.0.0 → fixed in 7.0.0

Description

A flaw was found in Ansible in the amazon.aws collection when using the `tower_callback` parameter from the `amazon.aws.ec2_instance` module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Related

Alias · CVE (1)

  • CVE-2022-3697 A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. vulnerability

Weakness · CWE (1)

  • CWE-233 Improper Handling of Parameters weakness

References