Every CVE Search/ Get API key

CVE-2022-3697

Ansible leaks password to logs

7.5 HighFix available

CVE-2022-3697 is a high vulnerability (CVSS 7.5) in Redhat Ansible, published October 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in ansible 7.0.0.

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.90%Unchanged since Oct 29, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Record
CVE-2022-3697
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-233
Updated
2026-11-02
CVE List No score

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Record
CVE-2022-3697
Weakness
CWE-233
Updated
2026-11-02
EUVDEUVD-2022-7080 No score

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Record
EUVD-2022-7080
Updated
2026-11-03
GitHub AdvisoriesGHSA-cpx3-93w7-457x 7.5

Ansible leaks password to logs

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Record
GHSA-cpx3-93w7-457x
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-233
Updated
2026-11-02
OSVDEBIAN-CVE-2022-3697 7.5

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Record
DEBIAN-CVE-2022-3697
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSVGHSA-cpx3-93w7-457x 7.5

Ansible leaks password to logs

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Record
GHSA-cpx3-93w7-457x
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-233
Updated
2026-11-02
Show 6 moreShow less
OSVOESA-2025-1125 7.5

ansible security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. %if 0 Provides: ansible-python3 = - Obsoletes: ansible-python3 < - BuildRequires: python3-devel python3-setuptools BuildRequires: python3-PyYAML python3-paramiko python3-crypto python3-packaging BuildRequires: python3-pexpect python3-winrm BuildRequires: git-core %if %with_docs BuildRequires: python3-sphinx python3-sphinx-theme-alabaster asciidoc %endif BuildRequires: python3-six python3-nose python3-pytest python3-pytest-xdist BuildRequires: python3-pytest-mock python3-requests python3-coverage python3-mock BuildRequires: python3-boto3 python3-botocore python3-passlib python3-jinja2 Requires: python3-PyYAML python3-paramiko python3-crypto python3-setuptools python3-six Requires: python3-jinja2 sshpass python3-jmespath %description Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. This package installs versions of ansible that execute on Python3. %endif

Security Fix(es):

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.(CVE-2022-3697)

An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.(CVE-2023-5115)

Record
OESA-2025-1125
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVPYSEC-2026-768 7.5

Ansible leaks password to logs

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Record
PYSEC-2026-768
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2022-3697 7.5

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Record
UBUNTU-CVE-2022-3697
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVCLSA-2023-1691083401 No score

Fix CVE(s): CVE-2022-3697

  • SECURITY UPDATE: improper handling of tower_callback parameter in amazon.aws collection
    • debian/patches/CVE-2022-3697.patch: ec2_instance - validate options on tower_callback
    • CVE-2022-3697
  • Enable unit testing.
Record
CLSA-2023-1691083401
Updated
2026-11-02
OSV No score

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Record
CVE-2022-3697
Weakness
CWE-233
Updated
2026-11-02
OSVUSN-6846-1 No score

ansible vulnerabilities

It was discovered that Ansible incorrectly handled certain inputs when using tower_callback parameter. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3697)

It was discovered that Ansible incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform a Template Injection. (CVE-2023-5764)

Record
USN-6846-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ansible
PyPI
 2.5.0 up to 7.0.0
7.0.0
ansible
TuxCare:Ubuntu:18.04
 before 2.5.1+dfsg-1ubuntu0.1+tuxcare.els1
2.5.1+dfsg-1ubuntu0.1+tuxcare.els1
ansible
Debian:12
 before 7.0.0+dfsg-1
7.0.0+dfsg-1
ansible
Debian:13
 before 7.0.0+dfsg-1
7.0.0+dfsg-1
ansible
Debian:14
 before 7.0.0+dfsg-1
7.0.0+dfsg-1
ansible
Debian:10
 before 2.7.7+dfsg-1+deb10u2, plus listed versions
2.7.7+dfsg-12.7.7+dfsg-1+deb10u1
2.7.7+dfsg-1+deb10u2
ansible
PyPI
 2.5.0 up to 7.0.0, plus listed versions
2.10.02.10.0a12.10.0a22.10.0a32.10.0a4
Show 45 moreShow less
2.10.0a52.10.0a62.10.0a72.10.0a82.10.0a92.10.0b12.10.0b22.10.0rc12.10.12.10.22.10.32.10.42.10.52.10.62.10.72.5.12.5.102.5.112.5.122.5.132.5.142.5.152.5.22.5.32.5.42.5.52.5.62.5.72.5.82.5.92.6.02.6.0a12.6.0a22.6.0rc12.6.0rc22.6.0rc32.6.0rc42.6.0rc52.6.12.6.102.6.112.6.122.6.132.6.142.6.15
7.0.0
ansible
openEuler:24.03-LTS-SP1
 before 2.9.27-7.oe2403sp1
2.9.27-7.oe2403sp1
ansible
openEuler:20.03-LTS-SP4
 before 2.5.5-8.oe2003sp4
2.5.5-8.oe2003sp4
ansible
openEuler:22.03-LTS-SP3
 before 2.9.27-6.oe2203sp3
2.9.27-6.oe2203sp3
Show 11 moreShow less
Affected packages
PackageAffectedFixed
ansible
openEuler:22.03-LTS-SP4
 before 2.9.27-6.oe2203sp4
2.9.27-6.oe2203sp4
ansible
openEuler:24.03-LTS
 before 2.9.27-7.oe2403
2.9.27-7.oe2403
ansible
Ubuntu:Pro:18.04:LTS
 before 2.5.1+dfsg-1ubuntu0.1+esm2, plus listed versions
2.3.1.0+dfsg-22.5.0+dfsg-12.5.1+dfsg-12.5.1+dfsg-1ubuntu0.12.5.1+dfsg-1ubuntu0.1+esm1
2.5.1+dfsg-1ubuntu0.1+esm2
ansible
Ubuntu:Pro:20.04:LTS
 before 2.9.6+dfsg-1ubuntu0.1~esm2, plus listed versions
2.8.3+dfsg-12.8.6+dfsg-12.9.2+dfsg-12.9.4+dfsg-12.9.6+dfsg-12.9.6+dfsg-1ubuntu0.1~esm1
2.9.6+dfsg-1ubuntu0.1~esm2
ansible-core
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.12.0-12.12.0-1ubuntu0.1
 None known
ansible
Ubuntu:Pro:22.04:LTS
 before 2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4, plus listed versions
2.10.7+merged+base+2.10.8+dfsg-12.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm1
2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4
ansible-core
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.14.9-22.14.11-12.14.11-22.14.13-12.16.3-0ubuntu12.16.3-0ubuntu2
 None known
ansible-core
Ubuntu:25.10
 All versions, plus listed versions
2.18.1-4ubuntu12.19.0~beta4-1ubuntu12.19.0-1ubuntu1
 None known
ansible-core
Ubuntu:26.10
 All versions, plus listed versions
2.20.1-12.21.1~rc1-12.21.1~rc1-22.21.1~rc1-2ubuntu12.22.0~beta2-1
 None known
ansible-core
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.19.0-1ubuntu12.19.4-12.20.1-1
 None known
ansible
Ubuntu:Pro:16.04:LTS
 before 2.0.0.2-2ubuntu1.3+esm2, plus listed versions
1.9.2+dfsg-21.9.4-12.0.0.2-22.0.0.2-2ubuntu12.0.0.2-2ubuntu1.12.0.0.2-2ubuntu1.22.0.0.2-2ubuntu1.32.0.0.2-2ubuntu1.3+esm1
2.0.0.2-2ubuntu1.3+esm2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 12 moreShow less
This page doesn't list everything

Left out here: 179 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open