ALT-PU-2018-2199-1
Closed vulnerabilities
Published: 2018-06-08
BDU:2019-00887
Уязвимость системы управления конфигурациями Ansible, связанная c некорректной обработкой опции no_log, позволяющая нарушителю получить несанкционированный доступ к информации
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References:
Published: 2018-07-03
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2018-10855
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Severity: MEDIUM (5.9)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References:
- RHBA-2018:3788
- RHBA-2018:3788
- RHSA-2018:1948
- RHSA-2018:1948
- RHSA-2018:1949
- RHSA-2018:1949
- RHSA-2018:2022
- RHSA-2018:2022
- RHSA-2018:2079
- RHSA-2018:2079
- RHSA-2018:2184
- RHSA-2018:2184
- RHSA-2018:2585
- RHSA-2018:2585
- RHSA-2019:0054
- RHSA-2019:0054
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855
- USN-4072-1
- USN-4072-1
- DSA-4396
- DSA-4396
Closed bugs
Новая версия