CVE-2023-4237CWE-497

Platform: ec2_key module prints out the private key directly to the standard output

High · published October 4, 2023

CVSS v3.1
7.3
EPSS
0%
Percentile
15.7
In the wild
Unconfirmed
What it is

A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.7th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2023-10-04T14:23Z
EPSS history
Timeline
  • 04 OCT 14:23Z
    Platform: ec2_key module prints out the private key directly to the standard output
    cvelistv5