PT-2020-7684 · Ansible+1 · Ansible+2

Published 2014-04-22 · Updated 2022-05-17 · CVE-2014-4660

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ansible versions prior to 1.5.5

Description The issue allows local users to potentially obtain sensitive credential information in certain circumstances. This is possible when a file exists that uses the "deb http://user:pass@server:port/" format in sources.list. The problem arises from how filenames are constructed based on deb lines in sources.list, which might include user and password fields.

Recommendations For Ansible versions prior to 1.5.5, update to version 1.5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files that contain credential information in the sources.list format. Avoid using the deb http://user:pass@server:port/ format in sources.list until the issue is resolved.

Fix

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-522

Related Identifiers

ALT-PU-2014-1523

CVE-2014-4660

GHSA-5XM4-JMPW-P6J3

PYSEC-2020-202

Affected Products

Alt Linux

Ansible

Ansible-Core

References · 16

• https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-4660 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-4660 · Patch
• https://cve.org/CVERecord?id=CVE-2014-4660 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-4660 · Security Note
• https://osv.dev/vulnerability/GHSA-5xm4-jmpw-p6j3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-4660 · Vendor Advisory
• https://openwall.com/lists/oss-security/2014/06/26/19 · Patch
• https://osv.dev/vulnerability/PYSEC-2020-202 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4660 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-4660 · Vendor Advisory
• https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-202.yaml · Note
• https://securityfocus.com/bid/68231 · Note
• http://openwall.com/lists/oss-security/2014/06/26/19 · Note