CVE-2016-8614 Ansible apt_key module does not properly verify key fingerprint
Attackers can inject malicious OpenPGP keys by exploiting weak fingerprint verification in the Ansible apt_key module, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-8614?
CVE-2016-8614 is a medium-severity vulnerability in Red Hat Ansible, published on 31 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Which versions are affected by CVE-2016-8614?
3 open source packages ship an affected version, including ansible. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | All versions | 2.2.0.0 |
ansible PyPI | All versions | 2.2.0.0 |
ansible PyPI | All versions | 2.2.0.0 |
Products include Redhat Ansible.
How do I fix CVE-2016-8614?
Upgrade ansible to 2.2.0.0 or later.
Is CVE-2016-8614 being exploited?
There is no known exploitation of CVE-2016-8614 in the wild and no public exploit code.
Other vulnerabilities in Red Hat Ansible
Sources
Also known as CLSA-2025-1744116044, DEBIAN-CVE-2016-8614, GHSA-cmwx-9m2h-x7v4, PYSEC-2018-37, UBUNTU-CVE-2016-8614.