ansible, ansible community.aws, ansible amazon.aws
At a glance
- Source
- NVD
- EPSS
- EPSS 0.90 % · percentile 60 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.
Weaknesses (CWE)
- CWE-233 — Improper Handling of Parameters
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-cpx3-93w7-457x — Ansible leaks password to logs
- PYSEC-2026-768 — Ansible leaks password to logs
European references
- ENISA EUVD · EUVD-2022-7080
- GCVE · GCVE-0-2022-3697
CERT-FR advisories
- CERTFR-2025-AVI-1131 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.5.0 < 2.10.0cpe:2.3:a:redhat:ansible_collection:*:*:*:*:*:community_aws:*:*< 2.0.0cpe:2.3:a:redhat:ansible_collection:*:*:*:*:*:aws:*:*≥ 2.1.0 < 5.1.0
Affected products
| Product | Versions |
|---|---|
| ansible, ansible community.aws, ansible amazon.aws | affected ansible from 2.5.0 before 2.10 ; affected ansible community.aws before 2.0.0 ; affected ansible amazon.aws from 2.1.0 before 5.1.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |