CVE-2022-3697 Ansible leaks password to logs

What is CVE-2022-3697?

CVE-2022-3697 is a high-severity vulnerability in ansible, ansible community.aws, ansible amazon.aws, published on 28 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Weakness: CWE-233

Which versions are affected by CVE-2022-3697?

3 open source packages ship an affected version, including ansible. It affects 2 products.

Products include Redhat Ansible, Redhat Ansible Collection.

How do I fix CVE-2022-3697?

Upgrade ansible to 7.0.0 or later.

Is CVE-2022-3697 being exploited?

There is no known exploitation of CVE-2022-3697 in the wild and no public exploit code.

Other vulnerabilities in ansible, ansible community.aws, ansible amazon.aws

• CVE-2014-4657 Ansible Remote Code Execution Critical 9.8
• CVE-2014-4966 Ansible Arbitrary Code Execution Critical 9.8
• CVE-2014-4967 Ansible Arbitrary Code Execution Critical 9.8
• CVE-2017-7550 Ansible Insertion of Sensitive Information into Log File vulnerability Critical 9.8
• CVE-2014-3498 Ansible Arbitrary Code Execution High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2023-1691083401, DEBIAN-CVE-2022-3697, GHSA-cpx3-93w7-457x, PYSEC-2026-768, UBUNTU-CVE-2022-3697.