CVE-2015-1848: Medium severity Fedora Pacemaker Configuration System vulnerability
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1848?
CVE-2015-1848 has been classified as a medium severity vulnerability due to its potential to expose sensitive cookies to attackers.
How do I fix CVE-2015-1848?
To fix CVE-2015-1848, update to PCS version 0.9.138 or later, ensuring secure flags are set for cookies in HTTPS sessions.
What systems are affected by CVE-2015-1848?
CVE-2015-1848 affects PCS versions up to 0.9.137 and is relevant for various Red Hat Enterprise Linux and Pacemaker Configuration System installations.
What are the consequences of CVE-2015-1848 exploitation?
Exploitation of CVE-2015-1848 could allow remote attackers to intercept cookies during HTTP sessions, posing a risk of session hijacking.
Is there a workaround for CVE-2015-1848?
A temporary workaround for CVE-2015-1848 includes enforcing HTTPS everywhere and avoiding HTTP for sensitive sessions.