CVE-2018-10855

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
[UNKNOWN]	ansible	Ansible 2.4.5; Ansible 2.5.5

References

https://access.redhat.com/errata/RHBA-2018:3788Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1948Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1949Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2022Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2079Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2184Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2585Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0054Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855Issue Tracking, Vendor Advisory
https://usn.ubuntu.com/4072-1/Third Party Advisory
https://www.debian.org/security/2019/dsa-4396Third Party Advisory
https://access.redhat.com/errata/RHBA-2018:3788Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1948Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1949Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2022Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2079Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2184Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2585Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0054Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855Issue Tracking, Vendor Advisory
https://usn.ubuntu.com/4072-1/Third Party Advisory
https://www.debian.org/security/2019/dsa-4396Third Party Advisory

Timeline

Published: Jul 3, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-108568.8It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This resul CVE-2018-108577.5git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-ann CVE-2018-108588.8A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server cou CVE-2018-108597.5git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into CVE-2018-10867.5pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly CVE-2018-108607.5perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize CVE-2018-108618.1A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph s CVE-2018-108625.5WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war CVE-2018-108637.5It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store CVE-2018-108646.2An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may CVE-2018-108657.5It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenti CVE-2018-108669.1It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenti