CVE-2014-4658: 
Ansible vulnerability analysis and mitigation

The vault subsystem in Ansible before version 1.5.5 contains a security vulnerability (CVE-2014-4658) where it fails to set the umask before creation or modification of vault files. This vulnerability was discovered and disclosed in April 2014, affecting all Ansible installations prior to version 1.5.5. The vulnerability impacts the security of sensitive key information stored in vault files (Debian Security, OSS Security).

The vulnerability stems from the vault subsystem's failure to set appropriate umask restrictions before creating or modifying vault files. This oversight in the security implementation could expose sensitive data stored in these files. The issue was addressed in Ansible 1.5.5 with a security fix that ensures the umask is set to a restrictive mode before creating or editing vault files (Ansible Changelog).

The vulnerability allows local users to obtain sensitive key information by reading vault files that were created or modified with improper permissions (Debian Security).

The vulnerability was fixed in Ansible version 1.5.5. Users should upgrade to this version or later to ensure vault files are created with proper permissions. The fix ensures that the umask is set to a restrictive mode before any vault file operations (Ansible Changelog).