CVE-2014-4659
Fixed in a distro release EPSS <1%
Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format.
Products: redhat ansible
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible | 1.5.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ansible | 1.5.5+dfsg-1 |
| Debian 13 | ansible | 1.5.5+dfsg-1 |
| Debian 14 | ansible | 1.5.5+dfsg-1 |