Bug 1831254 (CVE-2014-4659)

Summary:	CVE-2014-4659 ansible: information disclosure through incorrect file permission
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	a.badger, akarol, bcoca, cmeyers, dbecker, dmetzger, gblomqui, gmainwar, gmccullo, gtanzill, hvyas, jcammara, jfrey, jhardy, jjoyce, jschluet, jtanner, kbasil, kevin, lhh, lpeer, mabashia, maxim, mburns, notting, obarenbo, puebele, rhos-maint, roliveri, rpetrell, sclewis, sdoran, simaishi, slinaber, smallamp, smcdonal, tkuratom, tvignaud, vbellur
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in ansible. Improper permissions on the sources.list might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format. The highest threat from this vulnerability is to data confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-05 22:31:49 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1831255, 1831256
Bug Blocks:	1831268

Description msiddiqu 2020-05-04 18:36:12 UTC

Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format.

References: 

https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md
https://www.securityfocus.com/bid/68234

Comment 1 msiddiqu 2020-05-04 18:37:02 UTC

Created ansible tracking bugs for this issue:

Affects: epel-all [bug 1831256]
Affects: fedora-all [bug 1831255]

Comment 2 Yadnyawalk Tale 2020-05-05 11:30:55 UTC

Red Hat CloudForms 5.10 (4.7) and 5.11 (5.0) do not ship `ansible` package, it is provided by the official Ansible repository.

Comment 3 Borja Tarraso 2020-05-05 12:56:24 UTC

This is a bug for Ansible 1.5.4 and previous versions, really old, and fixed on 1.5.5 and after long time ago, when it was Ansible Core. Currently we support 2.9.x, 2.8.x, and 2.7.x. and from 2.4 it is called Ansible Engine. So Ansible in all supported current versions is not affected.

Comment 4 Hardik Vyas 2020-05-05 13:03:21 UTC

Red Hat Ceph Storage and Red Hat Gluster Storage shipped ansible versions 2.4.1 and 2.3.2 respectively, which are not affected by this vulnerability.

Comment 5 Product Security DevOps Team 2020-05-05 22:31:49 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2014-4659