CVE-2014-4658

Advisory

Ansible 1.5.5 includes a fix for CVE-2014-4658: The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Security fix for vault, to ensure the umask is set to a restrictive mode before creating/editing vault files.
- Backported apt_repository security fixes relating to filename/mode upon sources list file creation.

Resources

• https://pypi.org/project/ansible
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4658
• https://www.securityfocus.com/bid/68233
• https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md