5.9
Medium
CVE-2018-10855 Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks
Description
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ansible | Versions not published |
Other CVEs of ansible
The 7 CVEs of ansible →
CVE-2019-14856
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
6.4
Medium
CVE-2018-16837
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen
7.8
High
CVE-2017-7481
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe
5.3
Medium
CVE-2018-10875
A flaw was found in ansible
7.8
High