CVE-2014-4660

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.

• CWE-522

• https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.mdRelease Notes
• https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08Patch
• https://security-tracker.debian.org/tracker/CVE-2014-4660Patch, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2014/06/26/19Mailing List, Patch, Third Party Advisory
• https://www.securityfocus.com/bid/68231Third Party Advisory, VDB Entry
• https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.mdRelease Notes
• https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08Patch
• https://security-tracker.debian.org/tracker/CVE-2014-4660Patch, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2014/06/26/19Mailing List, Patch, Third Party Advisory
• https://www.securityfocus.com/bid/68231Third Party Advisory, VDB Entry

Published

Feb 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-4654The snd_ctl_elem_add function in sound/core/control.c in the…
• CVE-2014-4655The snd_ctl_elem_add function in sound/core/control.c in the…
• CVE-2014-4656Multiple integer overflows in sound/core/control.c in the AL…
• CVE-2014-4657The safe_eval function in Ansible before 1.5.4 does not prop…9.8
• CVE-2014-4658The vault subsystem in Ansible before 1.5.5 does not set the…5.5
• CVE-2014-4659Ansible before 1.5.5 sets 0644 permissions for sources.list,…5.5
• CVE-2014-4661Cross-site scripting (XSS) vulnerability in HP Records Manag…
• CVE-2014-4663TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Websho…
• CVE-2014-4664Cross-site scripting (XSS) vulnerability in the Wordfence Se…
• CVE-2014-4667The sctp_association_free function in net/sctp/associola.c i…
• CVE-2014-4668The cherokee_validator_ldap_check function in validator_ldap…
• CVE-2014-4669HP Enterprise Maps 1.00 allows remote authenticated users to…