PT-2022-7598 · Ansible+4 · Ansible+5

Bastien-Roucaries · Published 2022-10-25 · Updated 2025-08-12 · CVE-2022-3697

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ansible (affected versions not specified)

Description A flaw was found in Ansible in the amazon.aws collection when using the tower callback parameter from the amazon.aws.ec2 instance module. This issue allows an attacker to take advantage of the insecure handling of the parameter, leading to the password leaking in the logs.

Recommendations As a temporary workaround, consider disabling the tower callback parameter in the amazon.aws.ec2 instance module until a patch is available. Restrict access to the amazon.aws.ec2 instance module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-233

Related Identifiers

BDU:2024-07358

CVE-2022-3697

DLA-3695-1

DLA-3695-2

GHSA-CPX3-93W7-457X

OESA-2025-1125

ROSA-SA-2024-2334

USN-6846-1

USN-6846-2

USN-6846-3

Affected Products

Ansible

Ansible-Core

Astra Linux

Linuxmint

Red Os

Ubuntu

References · 35

• https://nvd.nist.gov/vuln/detail/CVE-2022-3697 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-3697 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3697 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1221SE17MD · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-5764 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6846-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6846-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5115 · Security Note
• https://osv.dev/vulnerability/DLA-3695-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3695-2 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1125 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cpx3-93w7-457x · Vendor Advisory
• https://osv.dev/vulnerability/USN-6846-3 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6846-3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3697 · Vendor Advisory