CVE-2022-3697: High severity redhat ansible vulnerability
A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.
Other sources
A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.
— Launchpad
For the amazon.aws collection while looking into the way that the amazon.aws.ec2instance module handles the "towercallback" parameter. There is the potential for the Windows password to leak into logs when using "towercallback.setpassword".
Because the towercallback parameter is just a raw dict, rather than having options set, nolog does not come into play and towercallback.setpassword, if set, can be leaked into the logs.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 7.0.0 - Upgrade
Upgrade
debian/ansibleto a version that resolves this vulnerability.Fixed in 7.7.0+dfsg-3+deb12u1Fixed in 10.1.0+dfsg-1
Event History
Frequently Asked Questions
What is CVE-2022-3697?
CVE-2022-3697 is a vulnerability found in Ansible in the amazon.aws collection when using the `tower_callback` parameter from the `amazon.aws.ec2_instance` module.
What is the severity of CVE-2022-3697?
CVE-2022-3697 has a severity level of high.
How does CVE-2022-3697 affect Ansible?
CVE-2022-3697 affects Ansible when using the `tower_callback` parameter from the `amazon.aws.ec2_instance` module.
What is the remedy for CVE-2022-3697?
The remedy for CVE-2022-3697 is to upgrade to Ansible version 7.0.0 or newer.
Where can I find more information about CVE-2022-3697?
More information about CVE-2022-3697 can be found at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-3697), [GitHub - Ansible Collections](https://github.com/ansible-collections/amazon.aws/pull/1199), [GitHub - Ansible](https://github.com/ansible/ansible/pull/35749).