Description
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
Metrics
CVSS 3.1 5.5/10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.mdRelease Notes
- https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08Patch
- https://security-tracker.debian.org/tracker/CVE-2014-4660Patch, Third Party Advisory
- https://www.openwall.com/lists/oss-security/2014/06/26/19Mailing List, Patch, Third Party Advisory
- https://www.securityfocus.com/bid/68231Third Party Advisory, VDB Entry
- https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.mdRelease Notes
- https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08Patch
- https://security-tracker.debian.org/tracker/CVE-2014-4660Patch, Third Party Advisory
- https://www.openwall.com/lists/oss-security/2014/06/26/19Mailing List, Patch, Third Party Advisory
- https://www.securityfocus.com/bid/68231Third Party Advisory, VDB Entry
Timeline
- Published
- Feb 20, 2020
- Last modified
- Jun 17, 2026
- NVD status
- Modified