Read the docs
TI-2018-07669 Aliases CVE-2018-10855GHSA-jwcc-j78w-j73w

Sensitive information in log files in [UNKNOWN] ansible

Priority LOW 32CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 9 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

Why it matters now

EPSS 0.03088 87th percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.5.5, 2.4.5.0Red Hat: 7 advisoriesRed Hat: 9 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]ansibleAnsible 2.4.5; Ansible 2.5.5—No fix listedCNA
—ansible (PyPI)2.5.0a1 to before 2.5.52.5.5Patch availableGHSA-jwcc-j78w-j73w
—ansible (PyPI)2.4.0.0 to before 2.4.5.02.4.5.0Patch availableGHSA-jwcc-j78w-j73w
  • ansible Vendor[UNKNOWN] Affected Ansible 2.4.5; Ansible 2.5.5 Fixed in — No fix listed CNA
  • ansible (PyPI) Vendor— Affected 2.5.0a1 to before 2.5.5 Fixed in 2.5.5 Patch available GHSA-jwcc-j78w-j73w
  • ansible (PyPI) Vendor— Affected 2.4.0.0 to before 2.4.5.0 Fixed in 2.4.5.0 Patch available GHSA-jwcc-j78w-j73w

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*2.4 to before 2.4.5; after 2.5, up to 2.5.5VulnerableRed Hat
cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*4.6VulnerableRed Hat
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*13VulnerableRed Hat
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*10VulnerableRed Hat
cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*12VulnerableRed Hat
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
  • cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:* Versions 2.4 to before 2.4.5; after 2.5, up to 2.5.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:* Versions 12 Vulnerable ·Red Hat
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*19.04VulnerableCanonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical

Remediation

  • Fix · GHSA-jwcc-j78w-j73w ansible (PyPI) Fixed in 2.5.5 Advisory →
  • Fix · GHSA-jwcc-j78w-j73w ansible (PyPI) Fixed in 2.4.5.0 Advisory →

Red Hat 7 advisories

  • RHSA-2019:0054 Released 2019-01-16 · Red Hat rating Moderate
    ansible security update
    • Red Hat OpenStack Platform 10.0 ansible-2.4.6.0-1.el7ae
  • RHSA-2018:2585 Released 2018-08-29 · Red Hat rating Moderate
    ansible security update
    • Red Hat OpenStack Platform 13.0 ansible-2.4.6.0-1.el7ae
  • RHSA-2018:2184 Released 2018-07-12 · Red Hat rating Moderate
    CloudForms 4.6.3 bug fix and enhancement update
    • CloudForms Management Engine 5.9 ansible-2.4.5.0-1.el7ae, ansible-doc-2.4.5.0-1.el7ae, ansible-tower-3.2.5-1.el7at +12
Show 4 more Red Hat advisories
  • RHSA-2018:2079 Released 2018-06-28 · Red Hat rating Moderate
    Red Hat Virtualization security, bug fix, and enhancement update
    • RHEL 7-based RHEV-H for RHEV 4 (build requirements) imgbased-1.0.20-0.1.el7ev, python-imgbased-1.0.20-0.1.el7ev, redhat-release-virtualization-host-4.2-4.3.el7 +1
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host-4.2-20180622.0.el7_5, redhat-virtualization-host-image-update-4.2-20180622.0.el7_5
  • RHSA-2018:2022 Released 2018-06-26 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.4 for RHEL 7 Server ansible-2.4.5.0-1.el7ae, ansible-doc-2.4.5.0-1.el7ae
  • RHSA-2018:1949 Released 2018-06-19 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.5 for RHEL 7 Server ansible-2.5.5-1.el7ae, ansible-doc-2.5.5-1.el7ae
  • RHSA-2018:1948 Released 2018-06-19 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.5.5-1.el7ae, ansible-doc-2.5.5-1.el7ae

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 2AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat Quickstart Cloud Installer 1AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Will not fix
CloudForms Management Engine 5.9Fixed RHSA-2018:2184
RHEL 7-based RHEV-H for RHEV 4 (build requirements)Fixed RHSA-2018:2079
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2018:1948
Red Hat Ansible Engine 2.4 for RHEL 7 ServerFixed RHSA-2018:2022
Red Hat Ansible Engine 2.5 for RHEL 7 ServerFixed RHSA-2018:1949
Red Hat OpenStack Platform 10.0Fixed RHSA-2019:0054
Red Hat OpenStack Platform 12.0Fixed—
Red Hat OpenStack Platform 13.0Fixed RHSA-2018:2585
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2018:2079
Not affected: 1 product
  • Red Hat OpenShift Enterprise 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-10855
  2. 2026-10-03 Alias added: GHSA-jwcc-j78w-j73w

References

Advisory 13

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences