CVE-2022-3697

Name of the Vulnerable Software and Affected Versions Ansible (affected versions not specified)

Description A flaw was found in Ansible in the amazon.aws collection when using the tower callback parameter from the amazon.aws.ec2 instance module. This issue allows an attacker to take advantage of the insecure handling of the parameter, leading to the password leaking in the logs.

Recommendations As a temporary workaround, consider disabling the tower callback parameter in the amazon.aws.ec2 instance module until a patch is available. Restrict access to the amazon.aws.ec2 instance module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.