VULNERABILITY INTELLIGENCE
CVE-2016-8614
CVSS score6.3 MEDIUM
EPSS probability2.46%
CISA KEVNot currently listed
Published2018-07-31
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Description
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Weakness classification
- CWE-358: Improperly Implemented Security Check for Standard
Primary references
- secalert@redhat.com — Third Party Advisory, VDB Entry
- secalert@redhat.com — Exploit, Issue Tracking, Patch, Third Party Advisory
- secalert@redhat.com — Exploit, Third Party Advisory
- secalert@redhat.com — Third Party Advisory
- secalert@redhat.com — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory