CVE-2018-12557

    Dashboard / Vulnerabilities / CVE-2018-12557

    CVE-2018-12557

    Published: 19 Jun 2018Last Modified: 7 Aug 2026

    Summary:

    Details: An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could lead to accidentally leaking credentials or secrets.

    References: https://storyboard.openstack.org/#%21/story/2002177, http://lists.zuul-ci.org/pipermail/zuul-announce/2018-June/000015.html, https://git.zuul-ci.org/cgit/zuul/commit/?id=ffe7278c08e6e36bf8b18f732c764e00ff51551e

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8f77b30923b005c178ff5e4208c3171d038e8b0c
    Fixed -057d664ecc2ce151789e2488250b5e1da36d48a3

    Affected versions

    3.0.3
    3.0.2
    3.0.1
    3.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2018-12557 | CVE-DB