Key Management Errors Affecting ansible package, versions <2.2.0.0-1


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.11% (45th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN13-ANSIBLE-5674787
  • published27 Jun 2018
  • disclosed31 Jul 2018

Introduced: 27 Jun 2018

CVE-2016-8614  (opens in a new tab)
CWE-320  (opens in a new tab)

How to fix?

Upgrade Debian:13 ansible to version 2.2.0.0-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ansible package and not the ansible package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.