6.3med
CVE-2016-8614
Ansible apt_key module does not properly verify key fingerprint
Also known as GHSA-cmwx-9m2h-x7v4, PYSEC-2018-37
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.3
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
2.5%
percentile 85%
Public exploits
0
none known
Summary
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Exploit prediction (EPSS)
2.46% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | ansible | <2.2.0.0 | 2.2.0.0 |
Affected products
- Red Hat Ansible
Classification
References
- securityfocus.com /bid/94108 · vdb-entry, x_refsource_BID, x_transferred
- bugzilla.redhat.com /show_bug.cgi?id=CVE-2016-8614 · x_refsource_CONFIRM, x_transferred
- github.com /ansible/ansible-modules-core/pull/5353 · x_refsource_CONFIRM, x_transferred
- github.com /ansible/ansible-modules-core/pull/5357 · x_refsource_CONFIRM, x_transferred
- github.com /ansible/ansible-modules-core/issues/5237 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-8614 · advisory
- github.com /ansible/ansible-modules-core/commit/1182d1f0b76d56f3667e27987a10b9ec8f03357d · web
- github.com /ansible/ansible-modules-core/commit/66d47c8149d84e52f64b7c4d1f340d45dca94d9c · web
- github.com /advisories/GHSA-cmwx-9m2h-x7v4 · advisory
- github.com /ansible/ansible · package
- github.com /pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-37.yaml · web
- web.archive.org /web/20200227214450/https://www.securityfocus.com/bid/94108 · web
Sources
- CVE List: CVE-2016-8614
- GitHub Advisory: GHSA-cmwx-9m2h-x7v4
- NVD: CVE-2016-8614
- OSV: PYSEC-2018-37
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.