CVE-2018-10855
published 2018-07-03CVE-2018-10855: Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive…
PriorityP431medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
3.09%
86.2th percentile
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | ansible | < ansible 2.5.5+dfsg-1 (bookworm) | ansible 2.5.5+dfsg-1 (bookworm) |
| debian | debian_linux | — | — |
| redhat | ansible | >= 0 < 2.5.5+dfsg-1 | 2.5.5+dfsg-1 |
| redhat | ansible | >= 0 < 2.5.5+dfsg-1 | 2.5.5+dfsg-1 |
| redhat | ansible | >= 0 < 2.5.5+dfsg-1 | 2.5.5+dfsg-1 |
| redhat | ansible | >= 0 < 2.5.5+dfsg-1 | 2.5.5+dfsg-1 |
| redhat | ansible | >= 0 < 2.0.0.2-2ubuntu1.3 | 2.0.0.2-2ubuntu1.3 |
| redhat | ansible | >= 0 < 2.5.1+dfsg-1ubuntu0.1 | 2.5.1+dfsg-1ubuntu0.1 |
| redhat | ansible | >= 2.4.0.0 < 2.4.5.0 | 2.4.5.0 |
| redhat | ansible | >= 2.5.0a1 < 2.5.5 | 2.5.5 |
| redhat | ansible_engine | <= 2.5.5 | — |
| redhat | ansible_engine | — | — |
| redhat | ansible_engine | >= 2.4 < 2.4.5 | 2.4.5 |
| redhat | cloudforms | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
| redhat | virtualization | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian5.9LOW
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ansible vulnerabilities
osv·2019-07-24·CVSS 9.8
CVE-2017-7481 [CRITICAL] ansible vulnerabilities
ansible vulnerabilities
It was discovered that Ansible failed to properly handle sensitive information.
A local attacker could use those vulnerabilities to extract them.
(CVE-2017-7481)
(CVE-2018-10855)
(CVE-2018-16837)
(CVE-2018-16876)
(CVE-2019-10156)
It was discovered that Ansible could load configuration files from the current
working directory containing crafted commands. An attacker could run arbitrary
code as result.
(CVE-2018-10874)
(CVE-2018-10875)
It was discovered that Ansible fetch module had a path traversal vulnerability.
A local attacker could copy and overwrite files outside of the specified
destination.
(CVE-2019-3828)
OSV
Ansible exposes sensitive data in log files and on the terminal
osv·2018-10-10
CVE-2018-10855 [HIGH] Ansible exposes sensitive data in log files and on the terminal
Ansible exposes sensitive data in log files and on the terminal
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
GHSA
Ansible exposes sensitive data in log files and on the terminal
ghsa·2018-10-10
CVE-2018-10855 [HIGH] CWE-532 Ansible exposes sensitive data in log files and on the terminal
Ansible exposes sensitive data in log files and on the terminal
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
OSV
CVE-2018-10855: Ansible 2
osv·2018-07-03·CVSS 5.9
CVE-2018-10855 [MEDIUM] CVE-2018-10855: Ansible 2
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Ubuntu
Ansible vulnerabilities
vendor_ubuntu·2019-07-24·CVSS 9.8
CVE-2017-7481 [CRITICAL] Ansible vulnerabilities
Title: Ansible vulnerabilities
Summary: Several security issues were fixed in Ansible.
It was discovered that Ansible failed to properly handle sensitive information.
A local attacker could use those vulnerabilities to extract them.
(CVE-2017-7481)
(CVE-2018-10855)
(CVE-2018-16837)
(CVE-2018-16876)
(CVE-2019-10156)
It was discovered that Ansible could load configuration files from the current
working directory containing crafted commands. An attacker could run arbitrary
code as result.
(CVE-2018-10874)
(CVE-2018-10875)
It was discovered that Ansible fetch module had a path traversal vulnerability.
A local attacker could copy and overwrite files outside of the specified
destination.
(CVE-2019-3828)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs
vendor_redhat·2018-06-11·CVSS 5.9
CVE-2018-10855 [MEDIUM] CWE-532 ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs
ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Statement: Red Hat Glust
Debian
CVE-2018-10855: ansible - Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task...
vendor_debian·2018·CVSS 5.9
CVE-2018-10855 [MEDIUM] CVE-2018-10855: ansible - Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task...
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Scope: local
bookworm: resolved (fixed in 2.5.5+dfsg-1)
bullseye: resolved (fixed in 2.5.5+dfsg-1)
forky: resolved (fixed in 2.5.5+dfsg-1)
sid: resolved (fixed in 2.5.5+dfsg-1)
trixie: resolved (fixed in 2.5.5+dfsg-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-10855 ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs [fedora-all]
bugzilla·2018-06-12·CVSS 5.9
CVE-2018-10855 [MEDIUM] CVE-2018-10855 ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs [fedora-all]
CVE-2018-10855 ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: t
Bugzilla
CVE-2018-10855 ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs [epel-all]
bugzilla·2018-06-12·CVSS 5.9
CVE-2018-10855 [MEDIUM] CVE-2018-10855 ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs [epel-all]
CVE-2018-10855 ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this
Bugzilla
CVE-2018-10855 ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs
bugzilla·2018-06-08·CVSS 5.9
CVE-2018-10855 [MEDIUM] CVE-2018-10855 ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs
CVE-2018-10855 ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs
Ansible through version 2.5 does not properly honour the no_log option with failed task iterations. When a list of secret items is supplied to a task and a task iteration fails, secrets can be disclosed in logs despite the no_log option being enabled.
Discussion:
We have a fix for this issue upstream
---
Acknowledgments:
Name: Tobias Henkel (BMW Car IT GmbH)
---
After talking to btarasso, we have pushed out a PR to address this: https://github.com/ansible/ansible/pull/41414 Will be merging that and backporting to stbale-2.4 stable-2.5 and stable-2.6 branches. Releases or release candidates with the fix applied will then be released from those branches.
---
Created ansible
https://access.redhat.com/errata/RHBA-2018:3788https://access.redhat.com/errata/RHSA-2018:1948https://access.redhat.com/errata/RHSA-2018:1949https://access.redhat.com/errata/RHSA-2018:2022https://access.redhat.com/errata/RHSA-2018:2079https://access.redhat.com/errata/RHSA-2018:2184https://access.redhat.com/errata/RHSA-2018:2585https://access.redhat.com/errata/RHSA-2019:0054https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855https://usn.ubuntu.com/4072-1/https://www.debian.org/security/2019/dsa-4396https://access.redhat.com/errata/RHBA-2018:3788https://access.redhat.com/errata/RHSA-2018:1948https://access.redhat.com/errata/RHSA-2018:1949https://access.redhat.com/errata/RHSA-2018:2022https://access.redhat.com/errata/RHSA-2018:2079https://access.redhat.com/errata/RHSA-2018:2184https://access.redhat.com/errata/RHSA-2018:2585https://access.redhat.com/errata/RHSA-2019:0054https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855https://usn.ubuntu.com/4072-1/https://www.debian.org/security/2019/dsa-4396
2018-07-03
Published