Ansible amazon.aws.ec2_instance Tower Callback Password Leak
CVE-2022-3697 Published on October 28, 2022
A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.
Weakness Type
Improper Handling of Parameters
The software does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.
Products Associated with CVE-2022-3697
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2022-3697 are published in these products:
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.