CVE-2014-4660: redhat ansible Insufficiently Protected Credentials
Vulnerability summary
CVE-2014-4660 is a medium (CVSS 5.5) Insufficiently Protected Credentials vulnerability in redhat ansible. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.7% of scored vulnerabilities.
Timeline
- 20-02-2020PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · PypiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
0.00 pp
From 0.38% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- ansible< 1.5.5+dfsg-1
PyPI1 product
- ansible< c4b5e46054c74176b2446c82d4df1a2610eddc08 | < 1.5.5
Redhat1 product
- ansible< 1.5.5
Ubuntu1 product
- ansible< 1.5.4+dfsg-1ubuntu0.1~esm2
4 vendors · 4 products
References
12 links- www.openwall.com/lists/oss-security/2014/06/26/19X Refsource MISCMailing ListPatchThird Party AdvisoryWEB
security-tracker.debian.org/tracker/CVE-2014-4660X Refsource MISCPatchThird Party AdvisoryWEBAdvisory- github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08X Refsource MISCPatchWEBFIX
