Skip to content
Fencer Intel
medium 5.9

CVE-2018-10855 json

Ansible exposes sensitive data in log files and on the terminal

published 8y ago modified 4mo ago also GHSA-jwcc-j78w-j73w , PYSEC-2018-42 , EUVD-2018-0015

cvss
5.9
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.0%
EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

Patch / fix

  • pypi ansible 2.4.5.0, 2.5.5
  • redhat ansible_engine 2.4.5
  • ansible Debian 14, Debian 13, Debian 12 2.5.5+dfsg-1

debian advisories DEBIAN-CVE-2018-10855

  • ansible Ubuntu 18.04 LTS 2.5.1+dfsg-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2018-10855

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ansible openstack 13, openstack 12, openstack 10 2.4.6.0-1.el7ae
  • ansible cloudforms managementengine 5.9, ansible engine 2.4 2.4.5.0-1.el7ae
  • ansible ansible engine 2.5, ansible engine 2 2.5.5-1.el7ae
  • imgbased RHEL 7 1.0.20-0.1.el7ev
  • python-imgbased RHEL 7 1.0.20-0.1.el7ev
  • redhat-virtualization-host RHEL 7 4.2-20180622.0.el7_5
  • redhat-release-virtualization-host RHEL 7 4.2-4.3.el7
  • redhat-virtualization-host-image-update RHEL 7 4.2-20180622.0.el7_5

red hat advisories RHSA-2018:2585RHSA-2018:2022RHSA-2018:1948RHSA-2018:1949RHSA-2018:2079RHSA-2019:0054

  • ansible OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 2.4.6.0-3.3.1

suse advisories SUSE-SU-2018:4130-1

  • ansible-14 openSUSE Tumbleweed 14.6.0-1.1
  • ansible-13 openSUSE Tumbleweed 13.7.0-1.1
  • ansible-12 openSUSE Tumbleweed 12.2.0-1.1
  • ansible-11 openSUSE Tumbleweed 11.11.0-1.1
  • ansible-10 openSUSE Tumbleweed 10.6.0-1.1
  • ansible-9 openSUSE Tumbleweed 9.8.0-1.1
  • ansible Package Hub 15 2.7.6-bp150.3.3.1

opensuse advisories openSUSE-SU-2026:12447-1openSUSE-SU-2026:10944-1openSUSE-SU-2025:15753-1openSUSE-SU-2025:15605-1openSUSE-SU-2024:14536-1openSUSE-SU-2024:14244-1

  • ansible Alpine 3.7 2.4.6.0-r0

alpine advisories ALPINE-CVE-2018-10855

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2018-10855 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-10855 updated cvss 5.9

ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs

  • Red Hat Ceph Storage 2 ansible Red Hat Ceph Storage 3 ansible Red Hat Quickstart Cloud Installer 1 ansible Red Hat Satellite 6 ansible Red Hat Storage 3 ansible
    affected: no fix planned “Will not fix”
  • Red Hat CloudForms Management Engine 5.9 cfme 5.9.3.4-1.el7cf, ansible 2.4.5.0-1.el7ae, ansible-tower 3.2.5-1.el7at, cfme-gemset 5.9.3.4-1.el7cf, ansible-tower-ui 3.2.5-1.el7at, cfme-appliance 5.9.3.4-1.el7cf, +8 more
    fixed: vendor fix RHSA-2018:2184
  • Red Hat Ansible Engine 2 for RHEL 7 ansible 2.5.5-1.el7ae
    fixed: vendor fix RHSA-2018:1948
  • Red Hat Ansible Engine 2.4 for RHEL 7 Server ansible 2.4.5.0-1.el7ae
    fixed: vendor fix RHSA-2018:2022
  • Red Hat Ansible Engine 2.5 for RHEL 7 Server ansible 2.5.5-1.el7ae
    fixed: vendor fix RHSA-2018:1949
  • Red Hat OpenStack Platform 10.0 ansible 2.4.6.0-1.el7ae
    fixed: vendor fix RHSA-2019:0054
  • Red Hat OpenStack Platform 12.0 ansible 2.4.6.0-1.el7ae, ansible-role-redhat-subscription 1.0.1-4.el7ost
    fixed: vendor fix RHBA-2018:3788
  • Red Hat OpenStack Platform 13.0 ansible 2.4.6.0-1.el7ae
    fixed: vendor fix RHSA-2018:2585
show 2 more
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.2-20180622.0.el7_5, redhat-virtualization-host-image-update 4.2-20180622.0.el7_5 Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) imgbased 1.0.20-0.1.el7ev, python-imgbased 1.0.20-0.1.el7ev, redhat-release-virtualization-host 4.2-4.3.el7, redhat-virtualization-host-image-update-placeholder 4.2-4.3.el7
    fixed: vendor fix RHSA-2018:2079
  • Red Hat OpenShift Enterprise 3 ansible
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.04% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi ansible
>=2.5.0a1, <2.5.5
>=2.4.0.0, <2.4.5.0
>=2.5, <2.5.5
>=2.4, <2.4.5.0
2.5.5
2.4.5.0

Affected products

  • [UNKNOWN] ansible

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.