ISOMAN

CVE

CVE-2018-10855

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

Severity
MEDIUM
CVSS
5.9
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource

References

  1. https://access.redhat.com/errata/RHBA-2018:3788
  2. https://access.redhat.com/errata/RHSA-2018:1948
  3. https://access.redhat.com/errata/RHSA-2018:1949
  4. https://access.redhat.com/errata/RHSA-2018:2022
  5. https://access.redhat.com/errata/RHSA-2018:2079
  6. https://access.redhat.com/errata/RHSA-2018:2184
  7. https://access.redhat.com/errata/RHSA-2018:2585
  8. https://access.redhat.com/errata/RHSA-2019:0054
  9. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855
  10. https://usn.ubuntu.com/4072-1/
  11. https://www.debian.org/security/2019/dsa-4396
  12. https://access.redhat.com/errata/RHBA-2018:3788
  13. https://access.redhat.com/errata/RHSA-2018:1948
  14. https://access.redhat.com/errata/RHSA-2018:1949
  15. https://access.redhat.com/errata/RHSA-2018:2022
  16. https://access.redhat.com/errata/RHSA-2018:2079
  17. https://access.redhat.com/errata/RHSA-2018:2184
  18. https://access.redhat.com/errata/RHSA-2018:2585
  19. https://access.redhat.com/errata/RHSA-2019:0054
  20. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855