CVE-2014-4660 json
Ansible discloses credential information
published 2020-02-20 6 y ago modified 2026-06-17 4 mo ago also GHSA-5xm4-jmpw-p6j3 , PYSEC-2020-202 , EUVD-2020-0014
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
Patch / fix
- pypi ansible 1.5.5
- redhat ansible 1.5.5
- ansible Debian 14, Debian 13, Debian 12 1.5.5+dfsg-1
debian advisories DEBIAN-CVE-2014-4660
- ansible Ubuntu Pro 14.04 LTS 1.5.4+dfsg-1ubuntu0.1~esm2
ubuntu advisories UBUNTU-CVE-2014-4660
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | ansible | <1.5.5 |
1.5.5 |
Classification
References
-
github.com
/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08
web, patch
-
openwall.com
/lists/oss-security/2014/06/26/19
web, mailing-list, patch, third-party-advisory
-
security-tracker.debian.org
/tracker/CVE-2014-4660
web, patch, third-party-advisory
-
github.com
/ansible/ansible/blob/release1.5.5/CHANGELOG.md
web, release-notes
-
securityfocus.com
/bid/68231
third-party-advisory, vdb-entry, web
-
nvd.nist.gov
/vuln/detail/CVE-2014-4660
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-202.yaml
web
-
web.archive.org
/web/20200229060002/https://www.securityfocus.com/bid/68231
web
-
github.com
/advisories/GHSA-5xm4-jmpw-p6j3
advisory
Sources
- CVE List CVE-2014-4660
- GitHub Advisory GHSA-5xm4-jmpw-p6j3
- NVD CVE-2014-4660
- OSV PYSEC-2020-202
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.