CVE-2014-4658

The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.

Score

CVSS 3.1 5.5 Medium

Status

Modified - cve@mitre.org

Published

2020-02-20

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Ansible (Redhat)

References

• https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md
• https://www.securityfocus.com/bid/68233