Name: CVE-2018-10855: Insertion of Sensitive Information into Log File
Creator: Rapid7
Published: 2018-07-02T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2018-10855, CWE-532, CVSS 5.9, EPSS 0.03372

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

CVSS Details

CVSS 3.1 Base Score: 5.9
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alpine Linux	—	Upgrade ansible	Sep 28, 2018	Jul 2, 2018
Debian	—	Upgrade ansible	Feb 20, 2019	Jul 2, 2018
Suse	—	Upgrade ansible	Feb 4, 2022	Jul 2, 2018
Ubuntu	—	Upgrade ansible	Jul 25, 2019	Jul 2, 2018

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence