Sensitive Information Disclosure

🗓️ 21 Apr 2024 05:57:53Reported by Veracode Vulnerability DatabaseType

Ansible Automation Platform vulnerable to Sensitive Information Disclosure due to improper handling of private keys

Reporter	Title	Published	Views	Family All 24
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Cartridge for IBM Cloud Pak for Data 4.8.1 is affected but not considered vulnerable to multiple vulnerabilities	26 Dec 202321:14	–	ibm
AstraLinux	Astra Linux - уязвимость в ansible	26 Jun 202413:32	–	astralinux
BDU FSTEC	The vulnerability of the ec2_key module in the Ansible configuration management system, due to deficiencies in the authentication process, allows attackers to access sensitive data, compromise its integrity, and cause service failures.	13 Sep 202400:00	–	bdu_fstec
Circl	CVE-2023-4237	4 Oct 202318:12	–	circl
CNNVD	Red Hat Ansible Automation Security Vulnerability	8 Aug 202300:00	–	cnnvd
CVE	CVE-2023-4237	4 Oct 202314:23	–	cve
Cvelist	CVE-2023-4237 Platform: ec2_key module prints out the private key directly to the standard output	4 Oct 202314:23	–	cvelist
Debian CVE	CVE-2023-4237	4 Oct 202314:23	–	debiancve
EUVD	EUVD-2023-2834	3 Oct 202520:07	–	euvd
Github Security Blog	Ansible may expose private key	4 Oct 202315:30	–	github

Vulners

Node

ansible ansibleMatch2.9.13+dfsg-1debian

AND

ansible ansibleMatch2.10.7+merged+base+2.10.8+dfsg-1debian

AND

ansible ansibleMatch2.9.13+dfsg-1debian

AND

Source	Link
security-tracker	www.security-tracker.debian.org/tracker/CVE-2023-4237
access	www.access.redhat.com/security/cve/CVE-2023-4237
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
security	www.security.netapp.com/advisory/ntap-20241025-0002/
access	www.access.redhat.com/errata/RHBA-2023:5653
access	www.access.redhat.com/errata/RHBA-2023:5666

22 Apr 2024 07:59Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.17.3 - 7.8

EPSS0.00239