CVE-2023-4237: Platform: ec2_key module prints out the private key directly to the standard output
First published: Tue Aug 08 2023(Updated: )
"When creating a new keypair the ec2_key module prints out the private key directly to the standard output. I wasn't able to find any way to disable this behavior in the module's documentation. This makes it unusable in any kind of public CI workflow such as GHA." Confirmed impacting all collection releases, and back to ansible-core 2.8 (did not test further back).
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Ansible Automation Platform | =2.0 | |
| Redhat Ansible Collection | ||
| pip/ansible-core | >=2.8.0<=2.15.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2023-4237
- https://bugzilla.redhat.com/show_bug.cgi?id=2229979
- https://nvd.nist.gov/vuln/detail/CVE-2023-4237
- https://github.com/advisories/GHSA-ww3m-ffrm-qvqv (Advisory)
- https://access.redhat.com/errata/RHBA-2023:5653
- https://access.redhat.com/errata/RHBA-2023:5666
Frequently Asked Questions
What is CVE-2023-4237?
CVE-2023-4237 is a vulnerability found in the Ansible Automation Platform that allows an attacker to fetch private keys from log files, compromising the system's confidentiality, integrity, and availability.
How does CVE-2023-4237 affect Redhat Ansible Automation Platform?
CVE-2023-4237 affects Redhat Ansible Automation Platform version 2.0.
How does CVE-2023-4237 affect Redhat Ansible Collection?
CVE-2023-4237 affects Redhat Ansible Collection.
How does CVE-2023-4237 affect pip/ansible-core?
CVE-2023-4237 affects pip/ansible-core versions 2.8.0 to 2.15.2.
What is the severity of CVE-2023-4237?
CVE-2023-4237 has a severity score of 7.8 (high).
How can I fix CVE-2023-4237?
To fix CVE-2023-4237, update to a patched version of the affected software.
- collector/nvd-index
- collector/github-advisory
- alias/GHSA-ww3m-ffrm-qvqv
- alias/CVE-2023-4237
- collector/github-advisory-latest
- collector/nvd-cve
- collector/nvd-api
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/severity
- agent/author
- agent/last-modified-date
- agent/description
- agent/tags
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- vendor/redhat
- canonical/redhat ansible automation platform
- version/redhat ansible automation platform/2.0
- canonical/redhat ansible collection
- package-manager/pip