CVE-2022-3697

NameCVE-2022-3697
DescriptionA flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3695-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ansible (PTS)jessie, jessie (lts)1.7.2+dfsg-2+deb8u3vulnerable
stretch (security), stretch (lts), stretch2.2.1.0-2+deb9u3vulnerable
buster (security), buster, buster (lts)2.7.7+dfsg-1+deb10u2fixed
bullseye2.10.7+merged+base+2.10.17+dfsg-0+deb11u1fixed
bookworm7.7.0+dfsg-3+deb12u1fixed
sid, trixie10.6.0+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ansiblesourcestretch(unfixed)end-of-life
ansiblesourcebuster2.7.7+dfsg-1+deb10u2DLA-3695-1
ansiblesourcebullseye2.10.7+merged+base+2.10.17+dfsg-0+deb11u1
ansiblesource(unstable)7.0.0+dfsg-1

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2137664
https://github.com/ansible-collections/amazon.aws/pull/1199

Search for package or bug name: Reporting problems