CVE-2018-12557

Name: CVE-2018-12557
Creator: NVD / NIST
Published: 2018-06-19T05:29:00.23+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.85%

Last modified Jun 17, 2026

CVE-2018-12557 is a vulnerability of currently unknown severity. An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. EPSS estimates a 1.85% chance of exploitation in the next 30 days.

Description

An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could lead to accidentally leaking credentials or secrets.

Metrics

EPSS Probability

1.85%

76.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-200

Affected Software

Vendor	Product	Versions
Zuul-Ci	Zuul	>= 3.0.0, < 3.1.0

References

http://lists.zuul-ci.org/pipermail/zuul-announce/2018-June/000015.htmlMailing List, Vendor Advisory
https://git.zuul-ci.org/cgit/zuul/commit/?id=ffe7278c08e6e36bf8b18f732c764e00ff51551ePatch, Vendor Advisory
https://storyboard.openstack.org/#%21/story/2002177
http://lists.zuul-ci.org/pipermail/zuul-announce/2018-June/000015.htmlMailing List, Vendor Advisory
https://git.zuul-ci.org/cgit/zuul/commit/?id=ffe7278c08e6e36bf8b18f732c764e00ff51551ePatch, Vendor Advisory
https://storyboard.openstack.org/#%21/story/2002177

Timeline

Published: Jun 19, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-12557?

How severe is CVE-2018-12557?

Severity scoring for CVE-2018-12557 is pending analysis. The EPSS model estimates a 1.85% probability of exploitation in the next 30 days.

How do I fix CVE-2018-12557?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-12557?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST