CVE-2014-4660
Ansible discloses credential information
CVE-2014-4660 is a medium vulnerability (CVSS 5.5) in Redhat Ansible, published February 20, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in ansible 1.5.5.
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
- Record
CVE-2014-4660- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
CVE List No score
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
- Record
CVE-2014-4660- Updated
- 2026-11-02
EUVDEUVD-2020-0014 No score
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
- Record
EUVD-2020-0014- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5xm4-jmpw-p6j3
Ansible discloses credential information
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the deb http://user:pass@server:port/ format.
- Record
GHSA-5xm4-jmpw-p6j3- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
- Record
CVE-2014-4660- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-4660
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
- Record
DEBIAN-CVE-2014-4660- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-5xm4-jmpw-p6j3
Ansible discloses credential information
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the deb http://user:pass@server:port/ format.
- Record
GHSA-5xm4-jmpw-p6j3- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-4660
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
- Record
UBUNTU-CVE-2014-4660- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVPYSEC-2020-202 No score
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.
- Record
PYSEC-2020-202- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ansiblePyPI |
before 1.5.5 | 1.5.5 |
ansibleDebian:12 |
before 1.5.5+dfsg-1 | 1.5.5+dfsg-1 |
ansibleDebian:13 |
before 1.5.5+dfsg-1 | 1.5.5+dfsg-1 |
ansibleDebian:14 |
before 1.5.5+dfsg-1 | 1.5.5+dfsg-1 |
ansiblePyPI |
before 1.5.5, plus listed versions 1.01.11.21.2.11.2.2 Show 17 moreShow less1.2.31.3.01.3.11.3.21.3.31.3.41.41.4.11.4.21.4.31.4.41.4.51.51.5.11.5.21.5.31.5.4 |
1.5.5 |
ansiblePyPI |
before 1.5.5, plus listed versions 1.01.11.21.2.11.2.2 Show 29 moreShow less1.2.31.3.01.3.11.3.21.3.31.3.41.41.4.11.4.21.4.31.4.41.4.51.51.5.11.5.21.5.31.5.4v1.5.4v1.5.3v1.5.0v1.5.2v1.4.0v1.2v1.1v1.00.70.30.0.10.01 |
1.5.5 |
ansibleUbuntu:Pro:14.04:LTS |
before 1.5.4+dfsg-1ubuntu0.1~esm2, plus listed versions 1.1+dfsg-11.3.4+dfsg-11.4.0+dfsg-11.4.1+dfsg-11.4.3+dfsg-11.4.4+dfsg-11.5.4+dfsg-11.5.4+dfsg-1ubuntu0.1~esm1 |
1.5.4+dfsg-1ubuntu0.1~esm2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |