ansible, ansible community.aws, ansible amazon.aws
En bref
- Source
- NVD
- EPSS
- EPSS 0.90 % · centile 60 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Rechercher sur…
Description
A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.
Faiblesses (CWE)
- CWE-233 — Improper Handling of Parameters
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-cpx3-93w7-457x — Ansible leaks password to logs
- PYSEC-2026-768 — Ansible leaks password to logs
Références européennes
- ENISA EUVD · EUVD-2022-7080
- GCVE · GCVE-0-2022-3697
Avis du CERT-FR
- CERTFR-2025-AVI-1131 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.5.0 < 2.10.0cpe:2.3:a:redhat:ansible_collection:*:*:*:*:*:community_aws:*:*< 2.0.0cpe:2.3:a:redhat:ansible_collection:*:*:*:*:*:aws:*:*≥ 2.1.0 < 5.1.0
Produits affectés
| Produit | Versions |
|---|---|
| ansible, ansible community.aws, ansible amazon.aws | affected ansible from 2.5.0 before 2.10 ; affected ansible community.aws before 2.0.0 ; affected ansible amazon.aws from 2.1.0 before 5.1.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |