CVE-2022-3697

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-28 · updated 2026-06-17
Weakness: CWE-233

Description

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Affected products

Red Hat Ansible: from 2.5.0 before 2.10.0 — fixed in 2.10.0
RedHat Ansible Collection: before 2.0.0; from 2.1.0 before 5.1.0 — fixed in 2.0.0, 5.1.0

How to fix

Upgrade to a fixed version: Red Hat Ansible 2.10.0; RedHat Ansible Collection 2.0.0, 5.1.0. Check the vendor advisory for mitigations.

References

https://github.com/ansible-collections/amazon.aws/pull/1199
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
https://github.com/ansible-collections/amazon.aws/pull/1199
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html

Get alerted when CVE-2022-3697 or the next vulnerability affects your stack