CVE-2016-8614

2018-07-3121:00:00

CWE-358

redhat

www.cve.org

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

8.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.4%

JSON

A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.

CNA Affected

[
  {
    "product": "Ansible",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "2.2.0"
      }
    ]
  }
]