Ansible before 1.5.5 constructs filenames containing user and password fields...
Vulnerability Description
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-4660
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md
- https://www.securityfocus.com/bid/68231
- https://www.openwall.com/lists/oss-security/2014/06/26/19
- https://security-tracker.debian.org/tracker/CVE-2014-4660
- https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08
More from redhat
View All →Affected Vendor
redhat
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.