-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ansible | pip | >= 2.5.0, < 7.0.0 | 7.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure handling of the tower_callback parameter in the ec2_instance module. Specifically, the 'set_password' sub-parameter under tower_callback was not marked with no_log=True in the module's argument specification. This allowed sensitive credentials to be leaked in Ansible logs. The fix in PR #1199 explicitly adds no_log=True to this parameter, confirming this was the vulnerable code path. The CWE-233 (Improper Parameter Handling) classification aligns with this failure to properly protect sensitive parameters from logging exposure.
A Semantic Attack on Google Gemini - Read the Latest Research