CVE-2023-4237
Platform: ec2_key module prints out the private key directly to the standard output
CVE-2023-4237 is a high vulnerability (CVSS 7.3) in Redhat Ansible Automation Platform, published October 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in ansible 7.7.0+dfsg-3+deb12u1.
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Platform: ec2_key module prints out the private key directly to the standard output
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
- Record
CVE-2023-4237- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-497
- Updated
- 2026-11-02
EUVDEUVD-2023-2834
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
- Record
EUVD-2023-2834- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ww3m-ffrm-qvqv
Ansible may expose private key
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
- Record
GHSA-ww3m-ffrm-qvqv- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-497
- Updated
- 2026-11-02
NVD
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
- Record
CVE-2023-4237- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-497
- Updated
- 2026-11-02
OSV
Platform: ec2_key module prints out the private key directly to the standard output
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
- Record
CVE-2023-4237- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-497
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-4237
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
- Record
DEBIAN-CVE-2023-4237- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-ww3m-ffrm-qvqv
Ansible may expose private key
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
- Record
GHSA-ww3m-ffrm-qvqv- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-497
- Updated
- 2026-11-02
OSVPYSEC-2026-1125
Ansible may expose private key
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
- Record
PYSEC-2026-1125- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-4237
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
- Record
UBUNTU-CVE-2023-4237- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ansible-corePyPI |
2.8.0 to 2.15.2 | None known |
ansibleDebian:12 |
before 7.7.0+dfsg-3+deb12u1, plus listed versions 7.3.0+dfsg-17.7.0+dfsg-17.7.0+dfsg-27.7.0+dfsg-3 |
7.7.0+dfsg-3+deb12u1 |
ansibleDebian:13 |
before 9.4.0+dfsg-1 | 9.4.0+dfsg-1 |
ansibleDebian:14 |
before 9.4.0+dfsg-1 | 9.4.0+dfsg-1 |
ansible-corePyPI |
2.8.0 to 2.15.2, plus listed versions 2.11.02.11.0b12.11.0b22.11.0b32.11.0b4 Show 45 moreShow less2.11.0rc12.11.0rc22.11.12.11.102.11.10rc12.11.112.11.11rc12.11.122.11.12rc12.11.1rc12.11.22.11.2rc12.11.32.11.3rc12.11.42.11.4rc12.11.52.11.5rc12.11.62.11.6rc12.11.72.11.7rc12.11.82.11.8rc12.11.92.11.9rc12.12.02.12.0b12.12.0b22.12.0rc12.12.12.12.102.12.10rc12.12.1rc12.12.22.12.2rc12.12.32.12.3rc12.12.42.12.4rc12.12.52.12.5rc12.12.62.12.6rc12.12.7 |
None known |
ansibleUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.1+dfsg-11.3.4+dfsg-11.4.0+dfsg-11.4.1+dfsg-11.4.3+dfsg-1 Show 5 moreShow less1.4.4+dfsg-11.5.4+dfsg-11.5.4+dfsg-1ubuntu0.1~esm11.5.4+dfsg-1ubuntu0.1~esm21.5.4+dfsg-1ubuntu0.1~esm3 |
None known |
ansibleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.9.2+dfsg-21.9.4-12.0.0.2-22.0.0.2-2ubuntu12.0.0.2-2ubuntu1.1 Show 8 moreShow less2.0.0.2-2ubuntu1.22.0.0.2-2ubuntu1.32.0.0.2-2ubuntu1.3+esm12.0.0.2-2ubuntu1.3+esm22.0.0.2-2ubuntu1.3+esm32.0.0.2-2ubuntu1.3+esm42.0.0.2-2ubuntu1.3+esm52.0.0.2-2ubuntu1.3+esm6 |
None known |
ansibleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.3.1.0+dfsg-22.5.0+dfsg-12.5.1+dfsg-12.5.1+dfsg-1ubuntu0.12.5.1+dfsg-1ubuntu0.1+esm1 Show 4 moreShow less2.5.1+dfsg-1ubuntu0.1+esm22.5.1+dfsg-1ubuntu0.1+esm32.5.1+dfsg-1ubuntu0.1+esm42.5.1+dfsg-1ubuntu0.1+esm5 |
None known |
ansibleUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.8.3+dfsg-12.8.6+dfsg-12.9.2+dfsg-12.9.4+dfsg-12.9.6+dfsg-12.9.6+dfsg-1ubuntu0.1~esm12.9.6+dfsg-1ubuntu0.1~esm22.9.6+dfsg-1ubuntu0.1~esm3 |
None known |
ansible-coreUbuntu:22.04:LTS |
All versions, plus listed versions 2.12.0-12.12.0-1ubuntu0.1 |
None known |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ansibleUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.10.7+merged+base+2.10.8+dfsg-12.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm12.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4 |
None known |
ansibleUbuntu:24.04:LTS |
All versions, plus listed versions 7.7.0+dfsg-17.7.0+dfsg-39.2.0+dfsg-0ubuntu49.2.0+dfsg-0ubuntu5 |
None known |
ansible-coreUbuntu:24.04:LTS |
All versions, plus listed versions 2.14.9-22.14.11-12.14.11-22.14.13-12.16.3-0ubuntu12.16.3-0ubuntu2 |
None known |
ansibleUbuntu:25.10 |
All versions, plus listed versions 11.2.0+dfsg-112.0.0~a2+dfsg-112.0.0~a4+dfsg-112.0.0~a6+dfsg-112.0.0~b1+dfsg-1 |
None known |
ansible-coreUbuntu:25.10 |
All versions, plus listed versions 2.18.1-4ubuntu12.19.0~beta4-1ubuntu12.19.0-1ubuntu1 |
None known |
ansibleUbuntu:26.10 |
All versions, plus listed versions 13.1.0+dfsg-1ubuntu113.4.0+dfsg-1 |
None known |
ansible-coreUbuntu:26.10 |
All versions, plus listed versions 2.20.1-12.21.1~rc1-12.21.1~rc1-22.21.1~rc1-2ubuntu12.22.0~beta2-1 |
None known |
ansibleUbuntu:26.04:LTS |
All versions, plus listed versions 12.0.0~b1+dfsg-112.0.0+dfsg-112.2.0+dfsg-113.1.0+dfsg-113.1.0+dfsg-1ubuntu1 |
None known |
ansible-coreUbuntu:26.04:LTS |
All versions, plus listed versions 2.19.0-1ubuntu12.19.4-12.20.1-1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
access.redhat.com/errata/RHBA-2023:5653
bugzilla.redhat.com/show_bug.cgi?id=2229979
security.netapp.com/advisory/ntap-20241025-0002
nvd.nist.gov/vuln/detail/CVE-2023-4237
Show 9 moreShow less
github.com/advisories/GHSA-ww3m-ffrm-qvqv
catalog.redhat.com/software/containers
security-tracker.debian.org/tracker/CVE-2023-4237
pypi.org/project/ansible-core
ubuntu.com/security/CVE-2023-4237
cve.org/CVERecord?id=CVE-2023-4237
Left out here: 86 versions. The JSON record has them.