CVE-2014-4660

medium

Description

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.

References

Advisories
More

https://www.securityfocus.com/bid/68231

https://www.openwall.com/lists/oss-security/2014/06/26/19

https://security-tracker.debian.org/tracker/CVE-2014-4660

https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08

https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md

Details

Source: Mitre, NVD

Published: 2020-02-20

Updated: 2020-02-25

Risk Information

CVSS v2

Base Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Severity: Low

CVSS v3

Base Score: 5.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 6.8

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00119