CVE-2023-4237

2023-10-0415:15:12

CWE-497

[email protected]

web.nvd.nist.gov

ansible

automation platform

cve-2023-4237

key pair

security vulnerability

confidentiality

integrity

availability

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system’s confidentiality, integrity, and availability.

Affected configurations

NVD

Node

redhatansible_automation_platformMatch2.0

redhatansible_collection

CPENameOperatorVersion
redhat:ansible_automation_platformredhat ansible automation platformeq2.0
redhat:ansible_collectionredhat ansible collectioneq*

CPE	Name	Operator	Version
redhat:ansible_automation_platform	redhat ansible automation platform	eq	2.0
redhat:ansible_collection	redhat ansible collection	eq	*

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.4 for RHEL 8",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "ansible-automation-platform-24/ee-supported-rhel8",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1.0.0-423",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform_cloud_billing:2.4::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.4 for RHEL 9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "ansible-automation-platform-24/ee-supported-rhel9",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1.0.0-424",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform_cloud_billing:2.4::el8"
    ]
  }
]