GHSA-cmwx-9m2h-x7v4
Ansible apt_key module does not properly verify key fingerprint
At a glance
- Published
- Updated
- CVE
- CVE-2016-8614
- Aliases
- PYSEC-2018-37
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Description
A flaw was found in Ansible before version 2.2.0.0. The `apt_key` module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Affected packages
| Package | Versions |
|---|---|
| PyPI · ansible | introduced 0, fixed 2.2.0.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-8614 ADVISORY
- https://github.com/ansible/ansible-modules-core/issues/5237 WEB
- https://github.com/ansible/ansible-modules-core/pull/5353 WEB
- https://github.com/ansible/ansible-modules-core/pull/5357 WEB
- https://github.com/ansible/ansible-modules-core/commit/1182d1f0b76d56f3667e27987a10b9ec8f03357d WEB
- https://github.com/ansible/ansible-modules-core/commit/66d47c8149d84e52f64b7c4d1f340d45dca94d9c WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614 WEB
- https://github.com/advisories/GHSA-cmwx-9m2h-x7v4 ADVISORY
- https://github.com/ansible/ansible PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-37.yaml WEB
- https://web.archive.org/web/20200227214450/https://www.securityfocus.com/bid/94108 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |