CVEvulnerability
CVE-2023-4237
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-10-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.3 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-497
Description
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
Affected configurations
• redhat ansible automation platform 2.0
• redhat ansible collection
Related
Weakness · CWE (1)
- CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere weakness
References
- https://access.redhat.com/errata/RHBA-2023:5653 access.redhat.com
- https://access.redhat.com/errata/RHBA-2023:5666 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2023-4237 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2229979 Issue Tracking, Vendor Advisory
- https://access.redhat.com/errata/RHBA-2023:5653 access.redhat.com
- https://access.redhat.com/errata/RHBA-2023:5666 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2023-4237 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2229979 Issue Tracking, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20241025-0002/ security.netapp.com