GHSA-jwcc-j78w-j73wHighCVSS 5.9

Ansible exposes sensitive data in log files and on the terminal

Published
October 10, 2018
Last Modified
November 18, 2024

🔗 CVE IDs covered (1)

CVE-2018-10855 →

📋 Description

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

🎯 Affected products2

  • pip/ansible:>= 2.5.0a1, < 2.5.5
  • pip/ansible:>= 2.4.0.0, < 2.4.5.0

🔗 References (14)