CVE-2014-4658: 
Ansible vulnerability analysis and mitigation

The vault subsystem in Ansible before version 1.5.5 contains a security vulnerability (CVE-2014-4658) where it fails to set the umask before creation or modification of vault files. This vulnerability was discovered and disclosed in April 2014, affecting all Ansible installations prior to version 1.5.5. The vulnerability impacts the security of sensitive key information stored in vault files (Debian Security, OSS Security).

The vulnerability stems from the vault subsystem's failure to set appropriate umask restrictions before creating or modifying vault files. This oversight in the security implementation could expose sensitive data stored in these files. The issue was addressed in Ansible 1.5.5 with a security fix that ensures the umask is set to a restrictive mode before creating or editing vault files (Ansible Changelog).

The vulnerability allows local users to obtain sensitive key information by reading vault files that were created or modified with improper permissions (Debian Security).

The vulnerability can be exploited by local users who have access to the system where Ansible vault files are stored. No remote exploitation vectors have been reported (Debian Security).

The vulnerability was fixed in Ansible version 1.5.5. Users should upgrade to this version or later to ensure vault files are created with proper permissions. The fix ensures that the umask is set to a restrictive mode before any vault file operations (Ansible Changelog).