CVE-2018-10855

MEDIUM

Redhat Ansible Engine < 2.4.5 - Log Information Exposure

Title source: rule
STIX 2.1

Description

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

References (11)

Core 11
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:1949
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHBA-2018:3788
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:1948
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2184
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2022
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:0054
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2079
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2585
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4396
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4072-1/

Scores

CVSS v3 5.9
EPSS 0.0299
EPSS Percentile 86.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-532
Status published
Products (12)
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 19.04
debian/debian_linux 9.0
pypi/ansible 2.5.0a1 - 2.5.5PyPI
redhat/ansible_engine 2.0
redhat/ansible_engine 2.4 - 2.4.5
redhat/cloudforms 4.6
redhat/openstack 13
redhat/openstack 10
... and 2 more
Published Jul 03, 2018
Tracked Since Feb 18, 2026