PyPI/ansible CVE-2016-8614: high 7.5, EPSS 2.46%
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and in
Action: Upgrade ansible to 2.2.0.0 or later.
pip install ansible==2.2.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.2.0.0 | - |
Fixed versions
| 2.2.0.0 |
Sources
- osv: PYSEC-2018-37
- nvd: CVE-2016-8614
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614
- https://github.com/ansible/ansible-modules-core/pull/5357
- https://github.com/ansible/ansible-modules-core/pull/5353
- https://github.com/ansible/ansible-modules-core/issues/5237
- http://www.securityfocus.com/bid/94108
- https://github.com/advisories/GHSA-cmwx-9m2h-x7v4
CVE-2016-8614 · published · modified · JSON