Ansible through version 2.5 does not properly honour the no_log option with failed task iterations. When a list of secret items is supplied to a task and a task iteration fails, secrets can be disclosed in logs despite the no_log option being enabled.
We have a fix for this issue upstream
Acknowledgments: Name: Tobias Henkel (BMW Car IT GmbH)
After talking to btarasso, we have pushed out a PR to address this: https://github.com/ansible/ansible/pull/41414 Will be merging that and backporting to stbale-2.4 stable-2.5 and stable-2.6 branches. Releases or release candidates with the fix applied will then be released from those branches.
Created ansible tracking bugs for this issue: Affects: epel-all [bug 1590199] Affects: fedora-all [bug 1590200]
I talked to bcoca about the upstream changelog entry for this today and he let me know that iteration is not necessary to provoke this bug. It is provoked by some (but not all) exceptions raised by a connection plugin. This will be the text of our changelog entry: "Some connection exceptions would cause no_log specified on a task to be ignored. If this happened, the task information, including any private information could have been displayed to stdout and (if enabled, not the default) logged to a log file specified in ansible.cfg's log_path. Additionally, sites which redirected stdout from ansible runs to a log file may have stored that private information onto disk that way as well"
This issue has been addressed in the following products: Red Hat Ansible Engine 2 for RHEL 7 Via RHSA-2018:1948 https://access.redhat.com/errata/RHSA-2018:1948
This issue has been addressed in the following products: Red Hat Ansible Engine 2.5 for RHEL 7 Via RHSA-2018:1949 https://access.redhat.com/errata/RHSA-2018:1949
External References: https://github.com/ansible/ansible/pull/41414
This issue has been addressed in the following products: Red Hat Ansible Engine 2.4 for RHEL 7 Via RHSA-2018:2022 https://access.redhat.com/errata/RHSA-2018:2022
This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 Via RHSA-2018:2079 https://access.redhat.com/errata/RHSA-2018:2079
This issue has been addressed in the following products: CloudForms Management Engine 5.9 Via RHSA-2018:2184 https://access.redhat.com/errata/RHSA-2018:2184
This issue has been addressed in the following products: Red Hat OpenStack Platform 13.0 (Queens) Via RHSA-2018:2585 https://access.redhat.com/errata/RHSA-2018:2585
This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2019:0054 https://access.redhat.com/errata/RHSA-2019:0054
Statement: Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.