CVE-2018-12557

Published: Jun 19, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could lead to accidentally leaking credentials or secrets.

Affected (1)

Products: Zuul Ci: Zuul

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zuul Ci Zuul	From 3.0.0 to 3.1.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

http://lists.zuul-ci.org/pipermail/zuul-announce/2018-June/000015.html

Source: cve@mitre.org

Mailing ListVendor Advisory

https://git.zuul-ci.org/cgit/zuul/commit/?id=ffe7278c08e6e36bf8b18f732c764e00ff51551e

Source: cve@mitre.org

PatchVendor Advisory

https://storyboard.openstack.org/#%21/story/2002177

Source: cve@mitre.org

http://lists.zuul-ci.org/pipermail/zuul-announce/2018-June/000015.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

https://git.zuul-ci.org/cgit/zuul/commit/?id=ffe7278c08e6e36bf8b18f732c764e00ff51551e

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://storyboard.openstack.org/#%21/story/2002177

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.