CVE-2016-8614

A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.

• CWE-358
• CWE-320

• http://www.securityfocus.com/bid/94108Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/ansible/ansible-modules-core/issues/5237Exploit, Third Party Advisory
• https://github.com/ansible/ansible-modules-core/pull/5353Third Party Advisory
• https://github.com/ansible/ansible-modules-core/pull/5357Third Party Advisory
• http://www.securityfocus.com/bid/94108Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/ansible/ansible-modules-core/issues/5237Exploit, Third Party Advisory
• https://github.com/ansible/ansible-modules-core/pull/5353Third Party Advisory
• https://github.com/ansible/ansible-modules-core/pull/5357Third Party Advisory

Published

Jul 31, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-8608JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS …5.4
• CVE-2016-8609It was found that the keycloak before 2.3.0 did not implemen…3.7
• CVE-2016-8610A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, …7.5
• CVE-2016-8611A vulnerability was found in Openstack Glance. No limits are…4.3
• CVE-2016-8612Apache HTTP Server mod_cluster before version httpd 2.4.23 i…
• CVE-2016-8613A flaw was found in foreman 1.5.1. The remote execution plug…6.4
• CVE-2016-8615A flaw was found in curl before version 7.51. If cookie stat…5.3
• CVE-2016-8616A flaw was found in curl before version 7.51.0 When re-using…3.7
• CVE-2016-8617The base64 encode function in curl before version 7.51.0 is …3.3
• CVE-2016-8618The libcurl API function called `curl_maprintf()` before ver…5.3
• CVE-2016-8619The function `read_data()` in security.c in curl before vers…5.3
• CVE-2016-8620The 'globbing' feature in curl before version 7.51.0 has a f…6.5