Ansible through version 2.5 does not properly honour the no_log option with failed task iterations. When a list of secret items is supplied to a task and a task iteration fails, secrets can be disclosed in logs despite the no_log option being enabled. 2.5.5 is already out with the fix: https://releases.ansible.com/ansible/ansible-2.5.5.tar.gz Gentoo Security Scout Florian Schuhmacher
2.5.5 fast stable'd with cleanup of 2.5.x (2.4.x is still in tree).
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d70cd9d1251b53bb6ac55bf5a7464bb744d6ae2c commit d70cd9d1251b53bb6ac55bf5a7464bb744d6ae2c Author: Matthew Thode <prometheanfire@gentoo.org> AuthorDate: 2018-06-15 22:05:25 +0000 Commit: Matthew Thode <prometheanfire@gentoo.org> CommitDate: 2018-06-15 22:05:25 +0000 app-admin/ansible: 2.5.5 stable amd64 and x86 with cleanup Closes: https://bugs.gentoo.org/658154 Package-Manager: Portage-2.3.40, Repoman-2.3.9 app-admin/ansible/Manifest | 3 -- app-admin/ansible/ansible-2.5.2.ebuild | 56 -------------------------- app-admin/ansible/ansible-2.5.3-r1.ebuild | 66 ------------------------------- app-admin/ansible/ansible-2.5.4.ebuild | 66 ------------------------------- app-admin/ansible/ansible-2.5.5.ebuild | 2 +- 5 files changed, 1 insertion(+), 192 deletions(-)
reopening...
