CVE-2014-4658: Ansible Vault Subsystem Local Key Information Disclosure
Summary
CVE-2014-4658: The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file. Affects ansible versions < 1.5.5. Fixed in 1.5.5. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2014-4658 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It provides a simple and agentless architecture, making it popular among system administrators and developers. The vault subsystem in Ansible is responsible for encrypting sensitive data, such as passwords and secret keys, using symmetric encryption. However, prior to version 1.5.5, the vault subsystem did not set the umask before creating or modifying a vault file, which resulted in a local key information disclosure vulnerability.
Vulnerability Detail
The vulnerability (CVE-2014-4658) in the Ansible vault subsystem allows local users to obtain sensitive key information by reading a file. This occurs due to the lack of proper file permissions when creating or modifying a vault file. As a result, an attacker with local access to the system can read the vault file and extract sensitive information, such as passwords or secret keys. This vulnerability can lead to unauthorized access to systems or services protected by Ansible.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.5
This is the first release that contains the fix.
pip install --upgrade "ansible==1.5.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Ansible is not immediately feasible, a workaround can be implemented by manually setting the appropriate file permissions for the vault file. This can be achieved by executing the following command:
$ chmod 600 <vault_file>
Conclusion
The vulnerability (CVE-2014-4658) in the Ansible vault subsystem exposes sensitive key information to local users, potentially leading to unauthorized access. It is crucial to upgrade to Ansible version 1.5.5 or later to mitigate this vulnerability. Alternatively, the appropriate file permissions can be manually set as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
The vault subsystem in Ansible is responsible for encrypting sensitive data, such as passwords and secret keys, using symmetric encryption.
The vulnerability allows local users to obtain sensitive key information by reading a file, potentially leading to unauthorized access to systems or services protected by Ansible.
To fix the vulnerability, it is recommended to upgrade to Ansible version 1.5.5 or later. Alternatively, you can manually set the appropriate file permissions for the vault file.
Yes, a workaround is available by manually setting the appropriate file permissions for the vault file using the 'chmod' command.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
