CVE-2016-8614
UnknownEPSS 2.46%
Last modified
CVE-2016-8614 is a vulnerability of currently unknown severity. A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.. EPSS estimates a 2.46% chance of exploitation in the next 30 days.
Description
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Ansible | < 2.2.0 |
References
- http://www.securityfocus.com/bid/94108Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614Exploit, Issue Tracking, Patch, Third Party Advisory
- https://github.com/ansible/ansible-modules-core/issues/5237Exploit, Third Party Advisory
- https://github.com/ansible/ansible-modules-core/pull/5353Third Party Advisory
- https://github.com/ansible/ansible-modules-core/pull/5357Third Party Advisory
- http://www.securityfocus.com/bid/94108Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614Exploit, Issue Tracking, Patch, Third Party Advisory
- https://github.com/ansible/ansible-modules-core/issues/5237Exploit, Third Party Advisory
- https://github.com/ansible/ansible-modules-core/pull/5353Third Party Advisory
- https://github.com/ansible/ansible-modules-core/pull/5357Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-8614?
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
How severe is CVE-2016-8614?
Severity scoring for CVE-2016-8614 is pending analysis. The EPSS model estimates a 2.46% probability of exploitation in the next 30 days.
How do I fix CVE-2016-8614?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2016-8614?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST