CVE-2018-10855
Fixed in a distro release EPSS 3%CVSS 5.9
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Products: redhat ansible_engine, redhat cloudforms, redhat openstack, redhat virtualization, debian_linux, canonical ubuntu_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible | 2.5.5 |
| PyPI | ansible | 2.4.5.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.7 | ansible | 2.4.6.0-r0 |
| Debian 12 | ansible | 2.5.5+dfsg-1 |
| Debian 13 | ansible | 2.5.5+dfsg-1 |
| Debian 14 | ansible | 2.5.5+dfsg-1 |
| Debian 9 | ansible | 2.2.1.0-2+deb9u1 |
| Red Hat ansible engine 2 | ansible | 0:2.5.5-1.el7ae |
| Red Hat ansible engine 2 | ansible-doc | 0:2.5.5-1.el7ae |
| Red Hat ansible engine 2.4 | ansible | 0:2.4.5.0-1.el7ae |
| Red Hat ansible engine 2.4 | ansible-doc | 0:2.4.5.0-1.el7ae |
| Red Hat ansible engine 2.5 | ansible | 0:2.5.5-1.el7ae |
| Red Hat ansible engine 2.5 | ansible-doc | 0:2.5.5-1.el7ae |
| Red Hat cloudforms managementengine 5.9 | ansible | 0:2.4.5.0-1.el7ae |
| Red Hat cloudforms managementengine 5.9 | ansible-doc | 0:2.4.5.0-1.el7ae |
| Red Hat cloudforms managementengine 5.9 | ansible-tower | 0:3.2.5-1.el7at |
| Red Hat cloudforms managementengine 5.9 | ansible-tower-server | 0:3.2.5-1.el7at |
| Red Hat cloudforms managementengine 5.9 | ansible-tower-setup | 0:3.2.5-1.el7at |
| Red Hat cloudforms managementengine 5.9 | ansible-tower-ui | 0:3.2.5-1.el7at |
| Red Hat cloudforms managementengine 5.9 | ansible-tower-venv-ansible | 0:3.2.5-1.el7at |
| Red Hat cloudforms managementengine 5.9 | ansible-tower-venv-tower | 0:3.2.5-1.el7at |
| Red Hat cloudforms managementengine 5.9 | cfme | 0:5.9.3.4-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-amazon-smartstate | 0:5.9.3.4-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance | 0:5.9.3.4-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance-common | 0:5.9.3.4-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance-debuginfo | 0:5.9.3.4-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance-tools | 0:5.9.3.4-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-debuginfo | 0:5.9.3.4-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-gemset | 0:5.9.3.4-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-gemset-debuginfo | 0:5.9.3.4-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | httpd-configmap-generator | 0:0.2.2-1.1.el7cf |
| Red Hat Enterprise Linux 7 | imgbased | 0:1.0.20-0.1.el7ev |
| Red Hat Enterprise Linux 7 | python-imgbased | 0:1.0.20-0.1.el7ev |
| Red Hat Enterprise Linux 7 | redhat-release-virtualization-host | 0:4.2-4.3.el7 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host | 0:4.2-20180622.0.el7_5 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update | 0:4.2-20180622.0.el7_5 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update-placeholder | 0:4.2-4.3.el7 |
| Red Hat openstack 10 | ansible | 0:2.4.6.0-1.el7ae |
| Red Hat openstack 12 | ansible | 0:2.4.6.0-1.el7ae |
| Red Hat openstack 12 | ansible-role-redhat-subscription | 0:1.0.1-4.el7ost |
| Red Hat openstack 13 | ansible | 0:2.4.6.0-1.el7ae |
| SUSE HPE Helion OpenStack 8 | ansible | 2.4.6.0-3.3.1 |
| SUSE OpenStack Cloud 8 | ansible | 2.4.6.0-3.3.1 |
| SUSE OpenStack Cloud Crowbar 8 | ansible | 2.4.6.0-3.3.1 |
| SUSE Package Hub 15 | ansible | 2.7.6-bp150.3.3.1 |
| Ubuntu 16.04 LTS | ansible | 2.0.0.2-2ubuntu1.3 |
| Ubuntu 18.04 LTS | ansible | 2.5.1+dfsg-1ubuntu0.1 |
| openSUSE Tumbleweed | ansible-10 | 10.6.0-1.1 |
| openSUSE Tumbleweed | ansible-11 | 11.11.0-1.1 |
| openSUSE Tumbleweed | ansible-12 | 12.2.0-1.1 |
| openSUSE Tumbleweed | ansible-13 | 13.7.0-1.1 |
| openSUSE Tumbleweed | ansible-9 | 9.8.0-1.1 |