GHSA-cpx3-93w7-457x

Ansible leaks password to logs

Source: GitHub Advisory Database (reviewed) High CVE-2022-3697

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ansible	>= 2.5.0, < 7.0.0	7.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Ansible in the amazon.aws collection when using the `tower_callback` parameter from the `amazon.aws.ec2_instance` module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-3697 advisory
https://github.com/ansible-collections/amazon.aws/pull/1199 web
https://github.com/ansible/ansible/pull/35749 web
https://github.com/ansible-community/ansible-build-data/blob/main/6/CHANGELOG-v6.rst web
https://github.com/ansible/ansible package
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html web