CVE-2014-4658 — Vulnetix

CVE-2014-4658 PUBLISHED

The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.

EPSS 0.05% · 17.2th percentile

Risk Scores

EPSS Score

0.05%

17.2th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:Pro:14.04:LTS	ansible	0, 1.1+dfsg-1, 1.3.4+dfsg-1

Exploit Intelligence

https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md (circl)
68233 (circl)

Timeline

Feb 20, 2020 CVE Published
Feb 25, 2020 CVE Updated
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Oct 26, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 9, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 2, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2014-4658 third-party-advisory
http://www.openwall.com/lists/oss-security/2014/06/26/19 third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2014-4658 third-party-advisory

Open in Interactive Console →