Vulnerability Description
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fedora | Pacemaker Configuration System | <= 0.9.137 |
| Redhat | Enterprise Linux High Availability | 6.0 |
| Redhat | Enterprise Linux High Availability Eus | 6.6.z |
| Redhat | Enterprise Linux Resilient Storage | 6.0 |
| Redhat | Enterprise Linux Resilient Storage Eus | 6.6.z |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159374.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159401.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159412.html
- http://rhn.redhat.com/errata/RHSA-2015-0980.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0990.htmlThird Party Advisory
- http://www.securityfocus.com/bid/74623Third Party Advisory
- https://bugzilla.redhat.com/attachment.cgi?id=1009855ExploitIssue Tracking
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159374.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159401.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159412.html
- http://rhn.redhat.com/errata/RHSA-2015-0980.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0990.htmlThird Party Advisory
- http://www.securityfocus.com/bid/74623Third Party Advisory
- https://bugzilla.redhat.com/attachment.cgi?id=1009855ExploitIssue Tracking
FAQ
What is CVE-2015-1848?
CVE-2015-1848 is a vulnerability with a CVSS score of 6.8 (MEDIUM). The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its tr...
How severe is CVE-2015-1848?
CVE-2015-1848 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-1848?
Check the references section above for vendor advisories and patch information. Affected products include: Fedora Pacemaker Configuration System, Redhat Enterprise Linux High Availability, Redhat Enterprise Linux High Availability Eus, Redhat Enterprise Linux Resilient Storage, Redhat Enterprise Linux Resilient Storage Eus.