A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the     amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module     is handling the parameter insecurely, leading to the password leaking in the logs. (CVE-2022-3697)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the
    amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module
    is handling the parameter insecurely, leading to the password leaking in the logs. (CVE-2022-3697)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6846-1 advisory.

    It was discovered that Ansible incorrectly handled certain inputs when using tower_callback parameter. If     a user or an automated system were tricked into opening a specially crafted input file, a remote attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3697)

    It was discovered that Ansible incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     perform a Template Injection. (CVE-2023-5764)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
248826	Linux Distros Unpatched Vulnerability : CVE-2022-3697	Nessus	Misc.	Local	high
414011	SCA: security update for ansible (GHSA-cpx3-93w7-457x)	Tenable Cloud Security	SCA Checks	Local	high
414011	SCA: security update for ansible (GHSA-cpx3-93w7-457x)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
200992	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Ansible vulnerabilities (USN-6846-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2022-3697

high

Tenable Plugins

high

high

high

high