What’s Vulnerable › Vulnerabilities

CVE-2014-4660

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-02-20 · updated 2026-06-17
• Weakness: CWE-522

Description

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.

Affected products

• Red Hat Ansible: before 1.5.5 — fixed in 1.5.5

How to fix

Upgrade to a fixed version: Red Hat Ansible 1.5.5. Check the vendor advisory for mitigations.

References

• https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md
• https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08
• https://security-tracker.debian.org/tracker/CVE-2014-4660
• https://www.openwall.com/lists/oss-security/2014/06/26/19
• https://www.securityfocus.com/bid/68231
• https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md
• https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08
• https://security-tracker.debian.org/tracker/CVE-2014-4660
• https://www.openwall.com/lists/oss-security/2014/06/26/19
• https://www.securityfocus.com/bid/68231

Get alerted when CVE-2014-4660 or the next vulnerability affects your stack