CVE-2015-1848

NameCVE-2015-1848
DescriptionThe pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pcs (PTS)buster0.10.1-2fixed
buster (security)0.10.1-2+deb10u1fixed
bullseye (security), bullseye0.10.8-1+deb11u1fixed
bookworm0.11.5-1+deb12u1fixed
sid, trixie0.11.7-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pcssource(unstable)(not affected)

Notes

- pcs <not-affected> (Fixed before initial release to Debian)
https://github.com/feist/pcs/commit/898204596a779673c88097bbdbe2d7ed6ed0cc8b (0.9.140)

Search for package or bug name: Reporting problems