GitHub Advisoryadvisory · PyPI

GHSA-6667-f46p-pg88 Ansible sets unsafe permissions for sources.list

MEDIUM Published 2022-05-17 Modified 2024-09-10 Official page ↗
Aliases
CVE-2014-4659
Ecosystem
PyPI
Packages
ansible
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-522
Reviewed
2024-01-31

Affected packages

• PyPI ansible: < 1.5.5 → fixed in 1.5.5

Description

Ansible before 1.5.5 sets 0644 permissions for `sources.list`, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the `&quot;deb http://user:pass@server:port/&quot;` format.

Related

Alias · CVE (1)

  • CVE-2014-4659 Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References