p PatchFirst

CVE-2018-10855

CVE-2018-10855

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

CVSS 5.9 · Medium · EPSS 3.1% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • ansible

    Versions
    • Ansible 2.4.5: Affected
    • Ansible 2.5.5: Affected

    No fix published

  • ansible Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.5.5+dfsg-1

    Update to 2.5.5+dfsg-1

  • ansible Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.5.5+dfsg-1

    Update to 2.5.5+dfsg-1

  • ansible Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.5.5+dfsg-1

    Update to 2.5.5+dfsg-1

  • ansible PyPI

    Versions
    • 2.5.0
    • 2.5.0a1
    • 2.5.0b1
    • 2.5.0b2
    • 2.5.0rc1
    • 2.5.0rc2
    • 2.5.0rc3
    • 2.5.1
    • 2.5.2
    • 2.5.3
    • 2.5.4
    Affected ranges
    • ECOSYSTEM: ≥ 2.5.0a1, < 2.5.5

    Update to 2.5.5

  • ansible PyPI

    Versions
    • 2.4.0.0
    • 2.4.1.0
    • 2.4.2.0
    • 2.4.3.0
    • 2.4.4.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.0.0, < 2.4.5.0

    Update to 2.4.5.0

  • ansible PyPI

    Versions
    • 2.4.0.0
    • 2.4.1.0
    • 2.4.2.0
    • 2.4.3.0
    • 2.4.4.0
    • 2.5.0
    • 2.5.1
    • 2.5.2
    • 2.5.3
    • 2.5.4
    Affected ranges
    • ECOSYSTEM: ≥ 2.5, < 2.5.5 ∪ ≥ 2.4, < 2.4.5.0

    Update to 2.5.5; Update to 2.4.5.0

  • ansible Ubuntu:18.04:LTS

    Versions
    • 2.3.1.0+dfsg-2
    • 2.5.0+dfsg-1
    • 2.5.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 2.5.1+dfsg-1ubuntu0.1

    Update to 2.5.1+dfsg-1ubuntu0.1

Original sources

Check your server →