7.3
Élevée
CVE-2023-4237 A flaw was found in the Ansible Automation Platform
Description
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 1.0 | premières → < 1.0.0-423 | 1.0.0-423 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 1.0 | premières → < 1.0.0-424 | 1.0.0-424 |
Références
- RHBA-2023:5653 access.redhat.com
- RHBA-2023:5666 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2229979 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Ansible Automation Platform 2.4 for RHEL 8
Les 21 CVE de Red Hat Ansible Automation Platform 2.4 for RHEL 8 →
CVE-2026-84719
Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
9.9
Critique
CVE-2026-75884
Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups
9.1
Critique
CVE-2026-84502
Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod
9.9
Critique
CVE-2026-84474
Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match
9.9
Critique