CVE-2014-4660: Ansible - Sensitive Credential Information Disclosure
Summary
CVE-2014-4660: Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumsta... Affects ansible across 2 version ranges.
< 1.5.5
< c4b5e46054c74176b2446c82d4df1a2610eddc08
Fixed in c4b5e46054c74176b2446c82d4df1a2610eddc08. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2014-4660 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate tasks such as configuration management, application deployment, and orchestration. It is widely used in IT infrastructure management and provides a simple and powerful way to automate complex tasks. However, prior to version 1.5.5, Ansible had a vulnerability that could lead to the disclosure of sensitive credential information.
Vulnerability Detail
The vulnerability in Ansible before version 1.5.5 arises from the construction of filenames containing user and password fields based on deb lines in sources.list. This vulnerability could be exploited by local users in opportunistic circumstances to obtain sensitive credential information. By leveraging the existence of a file that uses the "deb http://user:pass@server:port/" format, an attacker could gain access to the credentials stored in that file. This could have serious ramifications, as the exposed credentials could be used for unauthorized access or further attacks.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
c4b5e46054c74176b2446c82d4df1a2610eddc08
This is the first release that contains the fix.
pip install --upgrade "ansible==c4b5e46054c74176b2446c82d4df1a2610eddc08"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to upgrade to the fixed version of Ansible.
Conclusion
The vulnerability in Ansible before version 1.5.5 could allow local users to obtain sensitive credential information. It is crucial to upgrade to the fixed version to mitigate the risk of unauthorized access and further attacks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
This vulnerability could lead to the disclosure of sensitive credential information, which can be used for unauthorized access or further attacks.
To fix this vulnerability, you should upgrade to Ansible version 1.5.5 or later.
There are no specific workarounds mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the official Ansible advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
