CVE-2018-10855

2 advisories.

PyPI/ansible CVE-2018-10855: medium 5.9

Ansible exposes sensitive data in log files and on the terminal

Action: Upgrade ansible to 2.4.5.0 or later.

pip install ansible==2.5.5

pip install ansible==2.4.5.0

Affected

introduced	fixed	last affected
2.5.0a1	2.5.5	-
2.4.0.0	2.4.5.0	-

Fixed versions

2.5.5

2.4.5.0

Sources

osv: GHSA-jwcc-j78w-j73w
https://nvd.nist.gov/vuln/detail/CVE-2018-10855
https://access.redhat.com/errata/RHBA-2018:3788
https://access.redhat.com/errata/RHSA-2018:1948
https://access.redhat.com/errata/RHSA-2018:1949
https://access.redhat.com/errata/RHSA-2018:2022
https://access.redhat.com/errata/RHSA-2018:2079
https://access.redhat.com/errata/RHSA-2018:2184
https://access.redhat.com/errata/RHSA-2018:2585
https://access.redhat.com/errata/RHSA-2019:0054
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855
https://github.com/advisories/GHSA-jwcc-j78w-j73w
https://github.com/ansible/ansible
https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-42.yaml
https://usn.ubuntu.com/4072-1
https://www.debian.org/security/2019/dsa-4396

CVE-2018-10855 · published 2018-10-10T17:23:20Z · modified 2024-11-25T05:25:52.519043Z · JSON

PyPI/ansible CVE-2018-10855: unknown

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged,