CVE-2022-3697

NameCVE-2022-3697
DescriptionA flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3695-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ansible (PTS)bullseye2.10.7+merged+base+2.10.17+dfsg-0+deb11u1fixed
bullseye (security)2.10.7+merged+base+2.10.17+dfsg-0+deb11u2fixed
bookworm7.7.0+dfsg-3+deb12u1fixed
sid, trixie11.2.0+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ansiblesourcebuster2.7.7+dfsg-1+deb10u2DLA-3695-1
ansiblesourcebullseye2.10.7+merged+base+2.10.17+dfsg-0+deb11u1
ansiblesource(unstable)7.0.0+dfsg-1

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2137664
https://github.com/ansible-collections/amazon.aws/pull/1199
Search for package or bug name: Reporting problems