CVE-2023-4237

Published: Oct 4, 2023Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.

Affected (2)

Products: Redhat: Ansible Automation Platform, Ansible Collection

2 products

Ansible Automation Platform

Ansible Collection

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Ansible Automation Platform	Version 2.0
Redhat Ansible Collection	All versions

Related CWEs

Exposure of Sensitive System Information to an Unauthorized Control Sphere

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

References (9)

https://access.redhat.com/errata/RHBA-2023:5653

Source: secalert@redhat.com

https://access.redhat.com/errata/RHBA-2023:5666

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2023-4237

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2229979

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://access.redhat.com/errata/RHBA-2023:5653

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHBA-2023:5666

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/security/cve/CVE-2023-4237

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2229979

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://security.netapp.com/advisory/ntap-20241025-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.