CVE-2018-10855 Ansible exposes sensitive data in log files and on the terminal
Ansible fails to honor the no_log flag for failed tasks, exposing sensitive data in logs and terminal output.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10855?
CVE-2018-10855 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 2 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Weakness: CWE-532
Which versions are affected by CVE-2018-10855?
5 open source packages ship an affected version, including ansible. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | From 2.4.0.0 | 2.4.5.0 |
ansible PyPI | From 2.4.0.0 | 2.4.5.0 |
ansible PyPI | From 2.5 | 2.5.5, 2.4.5.0 |
ansible PyPI | From 2.5.0a1 | 2.5.5 |
ansible PyPI | From 2.5.0a1 | 2.5.5 |
Linux distribution packages (30)
ansible Red Hat:ansible_engine:2.4::el7 | All versions | 0:2.4.5.0-1.el7ae |
ansible-doc Red Hat:ansible_engine:2.4::el7 | All versions | 0:2.4.5.0-1.el7ae |
ansible Red Hat:ansible_engine:2.5::el7 | All versions | 0:2.5.5-1.el7ae |
ansible-doc Red Hat:ansible_engine:2.5::el7 | All versions | 0:2.5.5-1.el7ae |
ansible Red Hat:ansible_engine:2::el7 | All versions | 0:2.5.5-1.el7ae |
ansible-doc Red Hat:ansible_engine:2::el7 | All versions | 0:2.5.5-1.el7ae |
ansible Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:2.4.5.0-1.el7ae |
ansible-doc Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:2.4.5.0-1.el7ae |
ansible-tower Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.5-1.el7at |
ansible-tower-server Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.5-1.el7at |
ansible-tower-setup Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.5-1.el7at |
ansible-tower-ui Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.5-1.el7at |
ansible-tower-venv-ansible Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.5-1.el7at |
ansible-tower-venv-tower Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:3.2.5-1.el7at |
cfme Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.3.4-1.el7cf |
cfme-amazon-smartstate Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.3.4-1.el7cf |
cfme-appliance Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.3.4-1.el7cf |
cfme-appliance-common Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.3.4-1.el7cf |
cfme-appliance-debuginfo Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.3.4-1.el7cf |
cfme-appliance-tools Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.3.4-1.el7cf |
cfme-debuginfo Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.3.4-1.el7cf |
cfme-gemset Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.3.4-1.el7cf |
cfme-gemset-debuginfo Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:5.9.3.4-1.el7cf |
httpd-configmap-generator Red Hat:cloudforms_managementengine:5.9::el7 | All versions | 0:0.2.2-1.1.el7cf |
imgbased Red Hat:enterprise_linux:7::hypervisor | All versions | 0:1.0.20-0.1.el7ev |
python-imgbased Red Hat:enterprise_linux:7::hypervisor | All versions | 0:1.0.20-0.1.el7ev |
redhat-release-virtualization-host Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.2-4.3.el7 |
redhat-virtualization-host Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.2-20180622.0.el7_5 |
redhat-virtualization-host-image-update Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.2-20180622.0.el7_5 |
redhat-virtualization-host-image-update-placeholder Red Hat:enterprise_linux:7::hypervisor | All versions | 0:4.2-4.3.el7 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Redhat Ansible Engine, Redhat Cloudforms, Redhat Openstack, Redhat Virtualization.
How do I fix CVE-2018-10855?
Upgrade ansible to a fixed version for your release line: 2.4.5.0 or 2.5.5.
Is CVE-2018-10855 being exploited?
There is no known exploitation of CVE-2018-10855 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-10855, DEBIAN-CVE-2018-10855, GHSA-jwcc-j78w-j73w, MGASA-2018-0303, PYSEC-2018-42, RHSA-2018:1948 and 5 more.