CVE-2014-4659: Ansible - Sensitive Credential Information Disclosure
Summary
CVE-2014-4659: Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@s... Affects ansible versions < 1.5.5. Fixed in 1.5.5. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2014-4659 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry due to its simplicity and flexibility. However, prior to version 1.5.5, Ansible had a vulnerability that resulted in the incorrect permission setting for the sources.list file. This misconfiguration could potentially allow local users to access sensitive credential information in certain circumstances. The sources.list file is used to specify package repositories in Debian-based systems, and it can contain credentials in the format 'deb http://user:pass@server:port/'.
Vulnerability Detail
The vulnerability (CVE-2014-4659) in Ansible arises from the incorrect permission setting (0644) for the sources.list file. This misconfiguration allows local users to read the file and potentially obtain sensitive credential information. An attacker with local access to the system could exploit this vulnerability to gain unauthorized access to the package repositories and potentially escalate their privileges. It is important to note that this vulnerability only affects Ansible versions prior to 1.5.5.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.5
This is the first release that contains the fix.
pip install --upgrade "ansible==1.5.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Ansible is not immediately feasible, a temporary workaround is to manually set the correct permissions for the sources.list file. The file should be set to 0600, which restricts access to the owner only. This can be achieved by executing the following command:
chmod 0600 /path/to/sources.list
Conclusion
The vulnerability (CVE-2014-4659) in Ansible versions prior to 1.5.5 allows local users to potentially access sensitive credential information due to incorrect permission settings for the sources.list file. It is crucial to upgrade Ansible to version 1.5.5 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
The sources.list file is used in Debian-based systems to specify package repositories. It can contain credentials in the format 'deb http://user:pass@server:port/'.
The vulnerability occurs due to the incorrect permission setting (0644) for the sources.list file in Ansible versions prior to 1.5.5. This allows local users to read the file and potentially access sensitive credential information.
If exploited, this vulnerability could allow unauthorized access to package repositories and potentially lead to privilege escalation. Attackers with local access to the system could obtain sensitive credential information.
To fix this vulnerability, it is recommended to upgrade Ansible to version 1.5.5 or later. This version includes the necessary fix to set the correct permissions for the sources.list file.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
