Bug 2137664 (CVE-2022-3697)

Summary:	CVE-2022-3697 ansible: improper handling of tower_callback parameter in amazon.aws collection
Product:	[Other] Security Response	Reporter:	Borja Tarraso <btarraso>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, bcoca, epacific, jcammara, jhardy, jneedle, jobarker, jrouleau, mabashia, mchappel, simaishi, smcdonal, stcannon, teagle, tfister, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2137871
Bug Blocks:	2137206

Description Borja Tarraso 2022-10-25 18:43:29 UTC

For the amazon.aws collection while looking into the way that the amazon.aws.ec2_instance module handles the "tower_callback" parameter. There is the potential for the Windows password to leak into logs when using "tower_callback.set_password".

Because the tower_callback parameter is just a raw dict, rather than having options set, no_log does not come into play and tower_callback.set_password, if set, can be leaked into the logs.

Comment 2 Mark Chappell 2022-10-25 19:35:16 UTC

https://github.com/ansible-collections/amazon.aws/pull/1199

Comment 5 Mark Chappell 2022-10-28 15:04:01 UTC

Upstream amazon.aws 5.1.0 has now been released with the fix

- https://github.com/ansible-collections/amazon.aws/releases/tag/5.1.0
- https://galaxy.ansible.com/download/amazon-aws-5.1.0.tar.gz