CVE-2014-4659

Name of the Vulnerable Software and Affected Versions Ansible versions prior to 1.5.5

Description The issue allows local users to potentially obtain sensitive credential information by reading a file that uses the "deb http://user:pass@server:port/" format, due to the incorrect permissions set for sources.list.

Recommendations For Ansible versions prior to 1.5.5, update to version 1.5.5 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the sources.list file to prevent unauthorized access. Restrict access to sensitive credential information stored in the sources.list file until the issue is resolved.