cvelistv5 - cve-2014-4660

cve-2014-4660

Vulnerability from cvelistv5

Published

2020-02-20 02:08

Modified

2024-08-06 11:20

Severity ?

Summary

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.

References

URL	Tags
cve@mitre.org	https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md	Release Notes
cve@mitre.org	https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08	Patch
cve@mitre.org	https://security-tracker.debian.org/tracker/CVE-2014-4660	Patch, Third Party Advisory
cve@mitre.org	https://www.openwall.com/lists/oss-security/2014/06/26/19	Mailing List, Patch, Third Party Advisory
cve@mitre.org	https://www.securityfocus.com/bid/68231	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08	Patch
af854a3a-2127-422b-91ae-364da2661108	https://security-tracker.debian.org/tracker/CVE-2014-4660	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.openwall.com/lists/oss-security/2014/06/26/19	Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.securityfocus.com/bid/68231	Third Party Advisory, VDB Entry

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:20:26.880Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.securityfocus.com/bid/68231"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2014/06/26/19"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2014-4660"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-06-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \"deb http://user:pass@server:port/\" format."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-20T02:08:50",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.securityfocus.com/bid/68231"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2014/06/26/19"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2014-4660"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-4660",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \"deb http://user:pass@server:port/\" format."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md",
              "refsource": "MISC",
              "url": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"
            },
            {
              "name": "https://www.securityfocus.com/bid/68231",
              "refsource": "MISC",
              "url": "https://www.securityfocus.com/bid/68231"
            },
            {
              "name": "https://www.openwall.com/lists/oss-security/2014/06/26/19",
              "refsource": "MISC",
              "url": "https://www.openwall.com/lists/oss-security/2014/06/26/19"
            },
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2014-4660",
              "refsource": "MISC",
              "url": "https://security-tracker.debian.org/tracker/CVE-2014-4660"
            },
            {
              "name": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08",
              "refsource": "MISC",
              "url": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-4660",
    "datePublished": "2020-02-20T02:08:50",
    "dateReserved": "2014-06-25T00:00:00",
    "dateUpdated": "2024-08-06T11:20:26.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.5.5\", \"matchCriteriaId\": \"B658D27D-BE83-4627-A241-6733E17F79FA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \\\"deb http://user:pass@server:port/\\\" format.\"}, {\"lang\": \"es\", \"value\": \"Ansible versiones anteriores a 1.5.5, construye nombres de archivos que contienen campos de usuario y contrase\\u00f1a sobre la base de l\\u00edneas deb en sources.list, lo que podr\\u00eda permitir a usuarios locales obtener informaci\\u00f3n confidencial de credenciales en circunstancias oportunistas al aprovechar la existencia de un archivo que utiliza el formato \\\"deb http://user:pass@server:port/\\\".\"}]",
      "id": "CVE-2014-4660",
      "lastModified": "2024-11-21T02:10:39.940",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 2.1, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2020-02-20T03:15:10.653",
      "references": "[{\"url\": \"https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md\", \"source\": \"cve@mitre.org\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\"]}, {\"url\": \"https://security-tracker.debian.org/tracker/CVE-2014-4660\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.openwall.com/lists/oss-security/2014/06/26/19\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.securityfocus.com/bid/68231\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://security-tracker.debian.org/tracker/CVE-2014-4660\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.openwall.com/lists/oss-security/2014/06/26/19\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.securityfocus.com/bid/68231\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-522\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-4660\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-02-20T03:15:10.653\",\"lastModified\":\"2024-11-21T02:10:39.940\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \\\"deb http://user:pass@server:port/\\\" format.\"},{\"lang\":\"es\",\"value\":\"Ansible versiones anteriores a 1.5.5, construye nombres de archivos que contienen campos de usuario y contrase\u00f1a sobre la base de l\u00edneas deb en sources.list, lo que podr\u00eda permitir a usuarios locales obtener informaci\u00f3n confidencial de credenciales en circunstancias oportunistas al aprovechar la existencia de un archivo que utiliza el formato \\\"deb http://user:pass@server:port/\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-522\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.5.5\",\"matchCriteriaId\":\"B658D27D-BE83-4627-A241-6733E17F79FA\"}]}]}],\"references\":[{\"url\":\"https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://security-tracker.debian.org/tracker/CVE-2014-4660\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.openwall.com/lists/oss-security/2014/06/26/19\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.securityfocus.com/bid/68231\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://security-tracker.debian.org/tracker/CVE-2014-4660\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.openwall.com/lists/oss-security/2014/06/26/19\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.securityfocus.com/bid/68231\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}"
  }
}

gsd-2014-4660

Vulnerability from gsd

Modified

2023-12-13 01:22

Details

Aliases

CVE-2014-4660

Aliases

CVE-2014-4660

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2014-4660",
    "description": "Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \"deb http://user:pass@server:port/\" format.",
    "id": "GSD-2014-4660"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-4660"
      ],
      "details": "Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \"deb http://user:pass@server:port/\" format.",
      "id": "GSD-2014-4660",
      "modified": "2023-12-13T01:22:45.413499Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2014-4660",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \"deb http://user:pass@server:port/\" format."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md",
            "refsource": "MISC",
            "url": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"
          },
          {
            "name": "https://www.securityfocus.com/bid/68231",
            "refsource": "MISC",
            "url": "https://www.securityfocus.com/bid/68231"
          },
          {
            "name": "https://www.openwall.com/lists/oss-security/2014/06/26/19",
            "refsource": "MISC",
            "url": "https://www.openwall.com/lists/oss-security/2014/06/26/19"
          },
          {
            "name": "https://security-tracker.debian.org/tracker/CVE-2014-4660",
            "refsource": "MISC",
            "url": "https://security-tracker.debian.org/tracker/CVE-2014-4660"
          },
          {
            "name": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08",
            "refsource": "MISC",
            "url": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.5.5",
          "affected_versions": "All versions before 1.5.5",
          "cvss_v2": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-522",
            "CWE-937"
          ],
          "date": "2020-02-25",
          "description": "Ansible constructs filenames containing user and password fields on the basis of deb lines in `sources.list`, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the `deb http://user:pass@server:port/` format.",
          "fixed_versions": [
            "1.5.5"
          ],
          "identifier": "CVE-2014-4660",
          "identifiers": [
            "CVE-2014-4660"
          ],
          "not_impacted": "All versions starting from 1.5.5",
          "package_slug": "pypi/ansible",
          "pubdate": "2020-02-20",
          "solution": "Upgrade to version 1.5.5 or above.",
          "title": "Insufficiently Protected Credentials",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2014-4660",
            "https://www.securityfocus.com/bid/68231"
          ],
          "uuid": "951d70a0-53f3-4a53-bc5c-cd3ad3ac8115"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.5.5",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-4660"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \"deb http://user:pass@server:port/\" format."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-522"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2014-4660",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://security-tracker.debian.org/tracker/CVE-2014-4660"
            },
            {
              "name": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08"
            },
            {
              "name": "https://www.securityfocus.com/bid/68231",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://www.securityfocus.com/bid/68231"
            },
            {
              "name": "https://www.openwall.com/lists/oss-security/2014/06/26/19",
              "refsource": "MISC",
              "tags": [
                "Mailing List",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://www.openwall.com/lists/oss-security/2014/06/26/19"
            },
            {
              "name": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md",
              "refsource": "MISC",
              "tags": [
                "Release Notes"
              ],
              "url": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2020-02-25T20:13Z",
      "publishedDate": "2020-02-20T03:15Z"
    }
  }
}

pysec-2020-202

Vulnerability from pysec

Published

2020-02-20 03:15

Modified

2021-07-02 02:41

Details

Aliases

CVE-2014-4660

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ansible",
        "purl": "pkg:pypi/ansible"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "c4b5e46054c74176b2446c82d4df1a2610eddc08"
            }
          ],
          "repo": "https://github.com/ansible/ansible",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0",
        "1.1",
        "1.2",
        "1.2.1",
        "1.2.2",
        "1.2.3",
        "1.3.0",
        "1.3.1",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.4",
        "1.4.1",
        "1.4.2",
        "1.4.3",
        "1.4.4",
        "1.4.5",
        "1.5",
        "1.5.1",
        "1.5.2",
        "1.5.3",
        "1.5.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2014-4660"
  ],
  "details": "Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \"deb http://user:pass@server:port/\" format.",
  "id": "PYSEC-2020-202",
  "modified": "2021-07-02T02:41:33.239912Z",
  "published": "2020-02-20T03:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2014-4660"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08"
    },
    {
      "type": "WEB",
      "url": "https://www.securityfocus.com/bid/68231"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2014/06/26/19"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"
    }
  ]
}

cve-2014-4660

Vulnerability from fkie_nvd

Published

2020-02-20 03:15

Modified

2024-11-21 02:10

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
cve@mitre.org	https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md	Release Notes
cve@mitre.org	https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08	Patch
cve@mitre.org	https://security-tracker.debian.org/tracker/CVE-2014-4660	Patch, Third Party Advisory
cve@mitre.org	https://www.openwall.com/lists/oss-security/2014/06/26/19	Mailing List, Patch, Third Party Advisory
cve@mitre.org	https://www.securityfocus.com/bid/68231	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08	Patch
af854a3a-2127-422b-91ae-364da2661108	https://security-tracker.debian.org/tracker/CVE-2014-4660	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.openwall.com/lists/oss-security/2014/06/26/19	Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.securityfocus.com/bid/68231	Third Party Advisory, VDB Entry

Impacted products

	Vendor	Product	Version
	redhat	ansible	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B658D27D-BE83-4627-A241-6733E17F79FA",
              "versionEndExcluding": "1.5.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \"deb http://user:pass@server:port/\" format."
    },
    {
      "lang": "es",
      "value": "Ansible versiones anteriores a 1.5.5, construye nombres de archivos que contienen campos de usuario y contrase\u00f1a sobre la base de l\u00edneas deb en sources.list, lo que podr\u00eda permitir a usuarios locales obtener informaci\u00f3n confidencial de credenciales en circunstancias oportunistas al aprovechar la existencia de un archivo que utiliza el formato \"deb http://user:pass@server:port/\"."
    }
  ],
  "id": "CVE-2014-4660",
  "lastModified": "2024-11-21T02:10:39.940",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-02-20T03:15:10.653",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://security-tracker.debian.org/tracker/CVE-2014-4660"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.openwall.com/lists/oss-security/2014/06/26/19"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.securityfocus.com/bid/68231"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://security-tracker.debian.org/tracker/CVE-2014-4660"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.openwall.com/lists/oss-security/2014/06/26/19"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.securityfocus.com/bid/68231"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

ghsa-5xm4-jmpw-p6j3

Vulnerability from github

Published

2022-05-17 19:57

Modified

2024-09-10 22:16

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

Ansible discloses credential information

Details

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the deb http://user:pass@server:port/ format.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ansible"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2014-4660"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-16T21:59:13Z",
    "nvd_published_at": "2020-02-20T03:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in `sources.list`, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the `deb http://user:pass@server:port/` format.",
  "id": "GHSA-5xm4-jmpw-p6j3",
  "modified": "2024-09-10T22:16:58Z",
  "published": "2022-05-17T19:57:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4660"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-202.yaml"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2014-4660"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20200229060002/https://www.securityfocus.com/bid/68231"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2014/06/26/19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Ansible discloses credential information"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2014-4660

Vulnerability from cvelistv5

gsd-2014-4660

Vulnerability from gsd

pysec-2020-202

Vulnerability from pysec

cve-2014-4660

Vulnerability from fkie_nvd

ghsa-5xm4-jmpw-p6j3

Vulnerability from github

Tags

Sightings

Nomenclature