| Vulnerability Name: | CVE-2014-4660 (CCN-94096) | ||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2014-06-26 | ||||||||||||||||||||||||||||||||||||||||
| Published: | 2014-06-26 | ||||||||||||||||||||||||||||||||||||||||
| Updated: | 2020-02-25 | ||||||||||||||||||||||||||||||||||||||||
| Summary: | Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format. | ||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
| ||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N) 1.6 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
| ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-522 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2014-4660 Source: CCN Type: oss-security Mailing List, Thu 26 Jun 2014 Re: Ansible CVE requests Source: CCN Type: BID-68231 ansible CVE-2014-4660 Remote Information Disclosure Vulnerability Source: XF Type: UNKNOWN ansible-cve20144660-info-disc(94096) Source: CCN Type: Ansible Web Site Ansible Project Source: MISC Type: Release Notes https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md Source: MISC Type: Patch https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08 Source: MISC Type: Patch, Third Party Advisory https://security-tracker.debian.org/tracker/CVE-2014-4660 Source: MISC Type: Mailing List, Patch, Third Party Advisory https://www.openwall.com/lists/oss-security/2014/06/26/19 Source: MISC Type: Third Party Advisory, VDB Entry https://www.securityfocus.com/bid/68231 Source: CCN Type: WhiteSource Vulnerability Database CVE-2014-4660 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||