CVE-2018-12557
Critical
Description
An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could lead to accidentally leaking credentials or secrets.
SeverityCritical
CVSS9.8
Exploit probability—
ProductZuul
PublishedJun 19, 2018
First seenJun 19, 2018
How to fix
Update
- zuul-ci zuul3.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zuul-ci zuul | 3.0.0 ≤ v < 3.1.0 | 3.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.