Bug 1214115 (CVE-2023-4237)

Summary:	VUL-0: CVE-2023-4237: ansible,ansible1: ec2_key module prints out the private key directly to the standard output
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Robert Frohl <rfrohl>
Component:	Incidents	Assignee:	Galaxy Bugs <galaxy-bugs>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P2 - High	CC:	alexander.graul, artem.shiliaev, galaxy-bugs, gayane.osipyan, marina.latini, security-team, stoyan.manolov
Version:	unspecified	Flags:	stoyan.manolov: needinfo? (galaxy-bugs)
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/374480/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-4237:6.5:(AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Robert Frohl 2023-08-09 11:52:53 UTC

CVE-2023-4237

"When creating a new keypair the ec2_key module prints out the private key directly to the standard output. I wasn't able to find any way to disable this behavior in the module's documentation. This makes it unusable in any kind of public CI workflow such as GHA."

Confirmed impacting all collection releases, and back to ansible-core 2.8 (did not test further back).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-4237
https://bugzilla.redhat.com/show_bug.cgi?id=2229979

Comment 6 Alexander Graul 2023-09-08 08:12:52 UTC

We haven't yet had time to look into this in detail, we have a long backlog of bugs and this one having a medium (P3) priority did not help its case. If you bump the priority we can move this higher in our backlog. 

For SUMA we submitted ansible to have it available on a SLE-based control node that's operated by SUMA. It's not obvious to me if the reported behavior is a valid threat in our scenario. I think we show stdout in places that should not contain a private key, but I'm not sure that's the case for this specific output. We need to analyze this.

Comment 8 Artem Shiliaev 2024-01-23 14:53:10 UTC

Changed the priority so that we could take it into work at SUMA bug squad