CVE-2016-8614: High severity red hat ansible vulnerability
A flaw was found in Ansible before version 2.2.0. The aptkey module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Other sources
A flaw was found in Ansible before version 2.2.0.0. The aptkey module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-8614?
CVE-2016-8614 is a vulnerability in Ansible before version 2.2.0 that allows a remote adversary to create a malicious OpenPGP key.
What is the severity of CVE-2016-8614?
The severity of CVE-2016-8614 is high, with a CVSS score of 7.5.
How does CVE-2016-8614 affect Ansible?
CVE-2016-8614 affects Ansible before version 2.2.0, specifically the apt_key module.
How can an attacker exploit CVE-2016-8614?
An attacker can exploit CVE-2016-8614 by creating an OpenPGP key that matches the short key ID and injecting it instead of the correct key.
Is there a fix for CVE-2016-8614?
Yes, the fix for CVE-2016-8614 is to upgrade to Ansible version 2.2.0 or later.