Skip to content
OpenAdvisories
Medium · 5.9 CVE-2018-10855 EUVD-2018-0015GHSA-jwcc-j78w-j73wPYSEC-2018-42

Ansible exposes sensitive data in log files and on the terminal

Published Jul 2, 2018 · Updated Aug 5, 2024 · Assigned by redhat

Vendor: [UNKNOWN] Product: ansible Package: ansible Package: ansible Package: ansible Package: ansible Ecosystem: Alpine Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu

Description

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

Affected products

VendorProductAffectedFixed
[UNKNOWN] ansible Ansible 2.4.5, Ansible 2.5.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ansible 2.5.5+dfsg-1 —
Debian 13 ansible 2.5.5+dfsg-1 —
Debian 12 ansible 2.5.5+dfsg-1 —
Debian 9 ansible 2.2.1.0-2+deb9u1 DSA-4396-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS ansible 2.5.1+dfsg-1ubuntu0.1 USN-4072-1
Ubuntu 16.04 LTS ansible 2.0.0.2-2ubuntu1.3 USN-4072-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 imgbased +1 1.0.20-0.1.el7ev RHSA-2018:2079
RHEL 7 redhat-release-virtualization-host +1 4.2-4.3.el7 RHSA-2018:2079
RHEL 7 redhat-virtualization-host +1 4.2-20180622.0.el7_5 RHSA-2018:2079
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat OpenStack 13 ansible 2.4.6.0-1.el7ae RHSA-2018:2585
Red Hat OpenStack 12 ansible 2.4.6.0-1.el7ae RHBA-2018:3788
Red Hat OpenStack 12 ansible-role-redhat-subscription 1.0.1-4.el7ost RHBA-2018:3788
Red Hat OpenStack 10 ansible 2.4.6.0-1.el7ae RHSA-2019:0054
Red Hat CloudForms 5 ansible +1 2.4.5.0-1.el7ae RHSA-2018:2184
Red Hat CloudForms 5 ansible-tower +5 3.2.5-1.el7at RHSA-2018:2184
Red Hat CloudForms 5 cfme +5 5.9.3.4-1.el7cf RHSA-2018:2184
Red Hat CloudForms 5 httpd-configmap-generator 0.2.2-1.1.el7cf RHSA-2018:2184
Red Hat Ansible Engine 2 ansible +1 2.4.5.0-1.el7ae RHSA-2018:2022, RHSA-2018:1949, RHSA-2018:1948

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 ansible 2.7.6-bp150.3.3.1 openSUSE-SU-2019:0238-1
SUSE OpenStack Cloud Crowbar 8 ansible 2.4.6.0-3.3.1 SUSE-SU-2018:4130-1
SUSE OpenStack Cloud 8 ansible 2.4.6.0-3.3.1 SUSE-SU-2018:4130-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE HPE Helion OpenStack 8 ansible 2.4.6.0-3.3.1 SUSE-SU-2018:4130-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed ansible-10 10.6.0-1.1 openSUSE-SU-2024:14536-1
openSUSE Tumbleweed ansible-11 11.11.0-1.1 openSUSE-SU-2025:15605-1
openSUSE Tumbleweed ansible-12 12.2.0-1.1 openSUSE-SU-2025:15753-1
openSUSE Tumbleweed ansible-13 13.7.0-1.1 openSUSE-SU-2026:10944-1
openSUSE Tumbleweed ansible-14 14.6.0-1.1 openSUSE-SU-2026:12447-1
openSUSE Tumbleweed ansible-9 9.8.0-1.1 openSUSE-SU-2024:14244-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.7 ansible 2.4.6.0-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI ansible >= 2.5.0a1, < 2.5.5 2.5.5 GHSA-jwcc-j78w-j73w
PyPI ansible >= 2.4.0.0, < 2.4.5.0 2.4.5.0 GHSA-jwcc-j78w-j73w
PyPI ansible >= 2.5, < 2.5.5 · >= 2.4, < 2.4.5.0 2.5.5, 2.4.5.0 PYSEC-2018-42

Advisories 19

References