REDHAT-BUG-607179: Low severity conga vulnerability
It was reported that Luci's (Luci is a web based front-end component of the Conga cluster management system) user session timeout feature depended only on JavaScript script running in the user's browser. If user closed browser tab without logging out of Luci session and without closing browser, they could re-open Luci web interface and continue using the session even after the timeout period has elapsed.
References: http://sourceware.org/cluster/conga/
Acknowledgement:
Red Hat would like to thank George Hedfors of Cybercom Sweden East AB for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-607179?
The severity of REDHAT-BUG-607179 is considered medium due to the potential for session hijacking.
How do I fix REDHAT-BUG-607179?
To mitigate REDHAT-BUG-607179, ensure that session management is handled on the server side rather than relying solely on client-side JavaScript.
What systems are affected by REDHAT-BUG-607179?
REDHAT-BUG-607179 affects the Red Hat Conga system and its Luci web interface.
Can the vulnerability REDHAT-BUG-607179 lead to unauthorized access?
Yes, REDHAT-BUG-607179 can allow an attacker to gain unauthorized access to a user's session if not properly mitigated.
Is there a workaround for REDHAT-BUG-607179?
A possible workaround for REDHAT-BUG-607179 is to instruct users to log out manually before closing their browser tabs.