Information disclosure in Ansible - CVE-2018-10855
Published: July 2, 2018
Vulnerability identifier: #VU13542
CSH Severity: Low
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-10855
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper honor of the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Affected software
Ansible
Red Hat Ansible Engine
ansible (Alpine package)
ansible-role-redhat-subscription (Red Hat package)
ansible (Red Hat package)
ansible
Red Hat Virtualization
Red Hat Virtualization Host
CloudForms
Fedora
SUSE Linux
Red Hat OpenStack
Red Hat Ansible Engine
ansible (Alpine package)
ansible-role-redhat-subscription (Red Hat package)
ansible (Red Hat package)
ansible
Red Hat Virtualization
Red Hat Virtualization Host
CloudForms
Fedora
SUSE Linux
Red Hat OpenStack
How to mitigate CVE-2018-10855
The vulnerability is addressed in the versions 2.4.5, 2.5.5.
Ansible - addressed in versions 2.4.5, 2.5.5, 2.5.5-1.el7ae
ansible (Alpine package) - update to 2.4.6.0-r0
Red Hat OpenStack - update to 12
ansible-role-redhat-subscription (Red Hat package) - update to 1.0.1-4.el7ost
ansible (Red Hat package) - update to 2.4.6.0-1.el7ae
ansible - addressed in versions 2.5.5-1.el6, 2.5.5-1.el7, 2.5.5-2.fc27, 2.5.5-2.fc28
ansible (Alpine package) - update to 2.4.6.0-r0
Red Hat OpenStack - update to 12
ansible-role-redhat-subscription (Red Hat package) - update to 1.0.1-4.el7ost
ansible (Red Hat package) - update to 2.4.6.0-1.el7ae
ansible - addressed in versions 2.5.5-1.el6, 2.5.5-1.el7, 2.5.5-2.fc27, 2.5.5-2.fc28
External References
Related Security Bulletins
- Information disclosure in Red Hat Virtualization
- Information disclosure in Red Hat Virtualization
- Information disclosure in Red Hat CloudForms
- OpenSUSE Linux update for ansible
- Red Hat update for ansible
- Red Hat update for ansible
- Information disclosure in ansible (Alpine package)
- Red Hat Ansible Engine 2.5 for RHEL 7 update for ansible
- Fedora 27 update for ansible
- Fedora EPEL 6 update for ansible
- Fedora EPEL 7 update for ansible
- Fedora 28 update for ansible
- Multiple vulnerabilities in Red Hat OpenStack packages