Search for vulnerabilities
Vulnerability details: VCID-5r5b-u8py-aaan
Vulnerability ID VCID-5r5b-u8py-aaan
Aliases CVE-2016-8614
GHSA-cmwx-9m2h-x7v4
PYSEC-2018-37
Summary A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-320 Key Management Errors
CWE-358 Improperly Implemented Security Check for Standard
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-8614.html
cvssv3 6.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-8614.json
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00106 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00106 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00106 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00106 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00165 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00287 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00395 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00403 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
epss 0.00767 https://api.first.org/data/v1/epss?cve=CVE-2016-8614
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1388038
cvssv3.1 7.5 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8614
cvssv2 6.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-cmwx-9m2h-x7v4
cvssv3.1 5.0 https://github.com/ansible/ansible
generic_textual MODERATE https://github.com/ansible/ansible
cvssv3.1 7.5 https://github.com/ansible/ansible-modules-core/commit/1182d1f0b76d56f3667e27987a10b9ec8f03357d
generic_textual HIGH https://github.com/ansible/ansible-modules-core/commit/1182d1f0b76d56f3667e27987a10b9ec8f03357d
cvssv3.1 7.5 https://github.com/ansible/ansible-modules-core/commit/66d47c8149d84e52f64b7c4d1f340d45dca94d9c
generic_textual HIGH https://github.com/ansible/ansible-modules-core/commit/66d47c8149d84e52f64b7c4d1f340d45dca94d9c
cvssv3.1 7.5 https://github.com/ansible/ansible-modules-core/issues/5237
generic_textual HIGH https://github.com/ansible/ansible-modules-core/issues/5237
cvssv3.1 7.5 https://github.com/ansible/ansible-modules-core/pull/5353
generic_textual HIGH https://github.com/ansible/ansible-modules-core/pull/5353
cvssv3.1 7.5 https://github.com/ansible/ansible-modules-core/pull/5357
generic_textual HIGH https://github.com/ansible/ansible-modules-core/pull/5357
cvssv3.1 7.5 https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-37.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-37.yaml
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2016-8614
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2016-8614
cvssv3.1 7.5 https://web.archive.org/web/20200227214450/https://www.securityfocus.com/bid/94108
generic_textual HIGH https://web.archive.org/web/20200227214450/https://www.securityfocus.com/bid/94108
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-8614.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-8614.json
https://api.first.org/data/v1/epss?cve=CVE-2016-8614
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8614
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/ansible/ansible
https://github.com/ansible/ansible-modules-core/commit/1182d1f0b76d56f3667e27987a10b9ec8f03357d
https://github.com/ansible/ansible-modules-core/commit/66d47c8149d84e52f64b7c4d1f340d45dca94d9c
https://github.com/ansible/ansible-modules-core/issues/5237
https://github.com/ansible/ansible-modules-core/pull/5353
https://github.com/ansible/ansible-modules-core/pull/5357
https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-37.yaml
https://web.archive.org/web/20200227214450/https://www.securityfocus.com/bid/94108
http://www.securityfocus.com/bid/94108
1388038 https://bugzilla.redhat.com/show_bug.cgi?id=1388038
842984 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842984
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
CVE-2016-8614 https://nvd.nist.gov/vuln/detail/CVE-2016-8614
GHSA-cmwx-9m2h-x7v4 https://github.com/advisories/GHSA-cmwx-9m2h-x7v4
USN-7330-1 https://usn.ubuntu.com/7330-1/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-8614.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/ansible/ansible-modules-core/commit/1182d1f0b76d56f3667e27987a10b9ec8f03357d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/ansible/ansible-modules-core/commit/66d47c8149d84e52f64b7c4d1f340d45dca94d9c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/ansible/ansible-modules-core/issues/5237
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/ansible/ansible-modules-core/pull/5353
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/ansible/ansible-modules-core/pull/5357
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-37.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-8614
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-8614
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://web.archive.org/web/20200227214450/https://www.securityfocus.com/bid/94108
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.27712
EPSS Score 0.00095
Published At June 15, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.