CVE-2009-5051: Medium severity hastymail vulnerability

Published Jan 18, 2011

Updated

Hastymail2 before RC 8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Affected Software

10 affected components

Hastymail Hastymail2=rc1

Hastymail Hastymail2=rc2

Hastymail Hastymail2=beta3

Hastymail Hastymail2=rc3

Hastymail Hastymail2=rc5

Hastymail Hastymail2=beta1

Hastymail Hastymail2=rc4

Hastymail Hastymail2=rc6

Hastymail Hastymail2=beta2

Hastymail Hastymail2=rc7

Remediation

Patch Available

http://www.hastymail.org/security/

Event History

Jan 18, 2011

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-5051?

CVE-2009-5051 is considered a moderate vulnerability because it allows remote attackers to capture session cookies, potentially compromising user sessions.

How do I fix CVE-2009-5051?

To fix CVE-2009-5051, upgrade to the latest version of Hastymail2 that implements the secure flag for session cookies.

What does CVE-2009-5051 affect?

CVE-2009-5051 affects various versions of Hastymail2 prior to RC 8 that do not set the secure flag for session cookies during HTTPS sessions.

Who is impacted by CVE-2009-5051?

Users of Hastymail2 versions RC 1 through RC 7, as well as beta versions 1 through 3, are impacted by CVE-2009-5051.

Can CVE-2009-5051 be exploited remotely?

Yes, CVE-2009-5051 can be exploited remotely by attackers intercepting HTTP transmission to capture session cookies.