PT-2018-2516 · Red Hat+2 · Ansible+2

Sam Fowler + 1 · Published 2018-06-08 · Updated 2025-11-21 · CVE-2018-10855

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ansible versions 2.4 through 2.4.4 Ansible versions 2.5 through 2.5.4

Description The issue is related to the incorrect handling of the no log option in Ansible, which is designed to prevent task logging. When a task fails, sensitive data may be displayed in event logs and on the user's terminal, allowing a remote attacker to gain unauthorized access to information.

Recommendations For Ansible versions 2.4 through 2.4.4, update to version 2.4.5 or later. For Ansible versions 2.5 through 2.5.4, update to version 2.5.5 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

ALT-PU-2018-2162

BDU:2019-00887

CVE-2018-10855

DSA-4396-1

GHSA-JWCC-J78W-J73W

MGASA-2018-0303

OPENSUSE-SU-2019:0238-1

OPENSUSE-SU-2024:10615-1

OPENSUSE-SU-2024:14244-1

OPENSUSE-SU-2024:14536-1

OPENSUSE-SU-2025:15605-1

OPENSUSE-SU-2025:15753-1

PYSEC-2018-42

RHSA-2018:1948

RHSA-2018:1949

RHSA-2018:2022

RHSA-2018:2079

RHSA-2018:2184

RHSA-2018:2585

RHSA-2019:0054

SUSE-SU-2018:4130-1

USN-4072-1

Affected Products

Alt Linux

Ansible

Ubuntu

References · 102

• https://ubuntu.com/security/CVE-2018-10855 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10855 · Security Note
• https://access.redhat.com/errata/RHSA-2018:2022 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/ILGCAZWUN7RSPO3IEB46IIDRMCI3ALP3 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14244-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:4130-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2079 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14536-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-10855 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-10855 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-10855 · Security Note
• https://ubuntu.com/security/CVE-2017-7481 · Vendor Advisory
• https://usn.ubuntu.com/4072-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0303 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:0238-1 · Vendor Advisory