A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6846-1 advisory.

    It was discovered that Ansible incorrectly handled certain inputs when using tower_callback parameter. If     a user or an automated system were tricked into opening a specially crafted input file, a remote attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3697)

    It was discovered that Ansible incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     perform a Template Injection. (CVE-2023-5764)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2022-3697

high

Tenable Plugins

high