GitHub Advisoryadvisory · PyPI

GHSA-cmwx-9m2h-x7v4 Ansible apt_key module does not properly verify key fingerprint

HIGH Published 2018-10-10 Modified 2024-09-03 Official page ↗
Aliases
CVE-2016-8614
Ecosystem
PyPI
Packages
ansible
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-358
Reviewed
2020-06-16

Affected packages

• PyPI ansible: < 2.2.0.0 → fixed in 2.2.0.0

Description

A flaw was found in Ansible before version 2.2.0.0. The `apt_key` module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.

Related

Alias · CVE (1)

  • CVE-2016-8614 A flaw was found in Ansible before version 2.2.0. vulnerability

Weakness · CWE (1)

  • CWE-358 Improperly Implemented Security Check for Standard weakness

References