HIGH🇵🇱 Wersja polska

CVE-2022-3697

CVSS 7.5v3.1pub. 2022-10-28upd. 2024-11-21

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Red Hat Ansible

    APP
    Redhat
    2.5.0 – 2.10.0 (excl.)

  • Red Hat Ansible Collection

    APP
    Redhat
    < 2.0.02.1.0 – 5.1.0 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2014-4678CRITICAL9.8PL ✓same product

RCE w funkcji safe_eval w Ansible — niepełna poprawka CVE-2014-4657

CVE-2014-4657CRITICAL9.8PL ✓same product

RCE w funkcji safe_eval w Ansible przed wersją 1.5.4

CVE-2014-4966CRITICAL9.8PL ✓same product

RCE w Ansible poprzez wstrzyknięcie szablonów Jinja2

CVE-2014-4967CRITICAL9.8PL ✓same product

Ansible – argument injection w fact umożliwia RCE (CVE-2014-4967)

CVE-2017-7550CRITICAL9.8PL ✓same product

Ansible jenkins_plugin ujawnia hasła w logach zdalnych hostów