ID CVE-2015-3983
Summary The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types.
References
Vulnerable Configurations
  • Fedora Pacemaker Configuration System (PCS) 0.9.137
    cpe:2.3:a:fedora:pacemaker_configuration_system:0.9.137
CVSS
Base: 4.3 (as of 15-05-2015 - 10:46)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
redhat via4
advisories
  • bugzilla
    id 1208294
    title CVE-2015-1848 CVE-2015-3983 pcs: improper web session variable signing
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhsa:tst:20140675001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhsa:tst:20140675002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20140675003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20140675004
    • OR
      • AND
        • comment pcs is earlier than 0:0.9.137-13.el7_1.2
          oval oval:com.redhat.rhsa:tst:20150980005
        • comment pcs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20150980006
      • AND
        • comment python-clufter is earlier than 0:0.9.137-13.el7_1.2
          oval oval:com.redhat.rhsa:tst:20150980007
        • comment python-clufter is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20150980008
    rhsa
    id RHSA-2015:0980
    released 2015-05-12
    severity Important
    title RHSA-2015:0980: pcs security and bug fix update (Important)
  • bugzilla
    id 1208294
    title CVE-2015-1848 CVE-2015-3983 pcs: improper web session variable signing
    oval
    AND
    • comment pcs is earlier than 0:0.9.123-9.el6_6.2
      oval oval:com.redhat.rhsa:tst:20150990005
    • comment pcs is signed with Red Hat redhatrelease2 key
      oval oval:com.redhat.rhsa:tst:20150980006
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhsa:tst:20100842001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhsa:tst:20100842002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20100842003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20100842004
    rhsa
    id RHSA-2015:0990
    released 2015-05-12
    severity Important
    title RHSA-2015:0990: pcs security and bug fix update (Important)
rpms
  • pcs-0:0.9.137-13.el7_1.2
  • python-clufter-0:0.9.137-13.el7_1.2
  • pcs-0:0.9.123-9.el6_6.2
refmap via4
bid 74682
confirm https://bugzilla.redhat.com/attachment.cgi?id=1009855
fedora
  • FEDORA-2015-8761
  • FEDORA-2015-8765
  • FEDORA-2015-8788
Last major update 30-12-2016 - 21:59
Published 14-05-2015 - 10:59
Back to Top