Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the deb http://user:pass@server:port/ format.
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ansible | Redhat | * | 1.5.5 (excluding) |
| Ansible | Ubuntu | saucy | * |
| Ansible | Ubuntu | trusty | * |
| Ansible | Ubuntu | upstream | * |