CVE-2018-12557 Information disclosure in n/a
Zuul may leak credentials or secrets in console logs when nodes go offline during looped tasks, exposing sensitive data to anyone with log access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-12557?
CVE-2018-12557 is a critical vulnerability in n/a, published on 19 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could lead to accidentally leaking credentials or secrets.
Weakness: CWE-200
Which versions are affected by CVE-2018-12557?
It affects 1 product.
Products include Zuul-Ci Zuul.
How do I fix CVE-2018-12557?
No fix has been published for CVE-2018-12557 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-12557 being exploited?
There is no known exploitation of CVE-2018-12557 in the wild and no public exploit code.
Sources
Also known as GHSA-33rx-8w5x-4jgv.