p PatchFirst

CVE-2014-4660

CVE-2014-4660

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.

CVSS 6.8 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • ansible Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.5.5+dfsg-1

    Update to 1.5.5+dfsg-1

  • ansible Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.5.5+dfsg-1

    Update to 1.5.5+dfsg-1

  • ansible Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.5.5+dfsg-1

    Update to 1.5.5+dfsg-1

  • ansible PyPI

    Versions
    • 1.0
    • 1.1
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.4
    • 1.4.1
    • 1.4.2
    • 1.4.3
    • 1.4.4
    • 1.4.5
    • 1.5
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.5.4
    Affected ranges
    • ECOSYSTEM: < 1.5.5

    Update to 1.5.5

  • ansible PyPI

    Versions
    • 1.0
    • 1.1
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.4
    • 1.4.1
    • 1.4.2
    • 1.4.3
    • 1.4.4
    • 1.4.5
    • 1.5
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.5.4
    • v1.5.4
    • v1.5.3
    • v1.5.0
    • v1.5.2
    • v1.4.0
    • v1.2
    • v1.1
    • v1.0
    • 0.7
    • 0.3
    • 0.0.1
    • 0.01
    Affected ranges
    • GIT: < c4b5e46054c74176b2446c82d4df1a2610eddc08
    • ECOSYSTEM: < 1.5.5

    Update to 1.5.5

  • ansible Ubuntu:Pro:14.04:LTS

    Versions
    • 1.1+dfsg-1
    • 1.3.4+dfsg-1
    • 1.4.0+dfsg-1
    • 1.4.1+dfsg-1
    • 1.4.3+dfsg-1
    • 1.4.4+dfsg-1
    • 1.5.4+dfsg-1
    • 1.5.4+dfsg-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.5.4+dfsg-1ubuntu0.1~esm2

    Update to 1.5.4+dfsg-1ubuntu0.1~esm2

Original sources

Check your server →