Description
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ansible | 1.5.5+dfsg-1 | — |
| Debian 13 | ansible | 1.5.5+dfsg-1 | — |
| Debian 12 | ansible | 1.5.5+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | ansible | 1.5.4+dfsg-1ubuntu0.1~esm2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ansible | < 1.5.5 | 1.5.5 | GHSA-5xm4-jmpw-p6j3 |
References
- https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md
- https://www.securityfocus.com/bid/68231
- https://www.openwall.com/lists/oss-security/2014/06/26/19
- https://security-tracker.debian.org/tracker/CVE-2014-4660
- https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08