Description
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | novnc | 1:0.4+dfsg+1+20131010+gitf68af8af3d-4 | — |
| Debian 13 | novnc | 1:0.4+dfsg+1+20131010+gitf68af8af3d-4 | — |
| Debian 12 | novnc | 1:0.4+dfsg+1+20131010+gitf68af8af3d-4 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 6 | novnc | 0.5.1-2.el7ost | RHSA-2015:0788 |
| Red Hat OpenStack 5 | novnc | 0.5.1-2.el6ost | RHSA-2015:0834, RHSA-2015:0833 |
| Red Hat OpenStack 4 | novnc | 0.5.1-2.el6ost | RHSA-2015:0884 |
Advisories 4
- RHSA-2015:0884 Red Hat Security Advisory: novnc security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2015:0833 Red Hat Security Advisory: novnc security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2015:0834 Red Hat Security Advisory: novnc security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2015:0788 Red Hat Security Advisory: novnc security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- [oss-security] 20150217 CVE request: novnc: session hijack through insecurely set session token cookies mailing-list
- RHSA-2015:0833 vendor-advisory
- RHSA-2015:0884 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1193451
- https://github.com/kanaka/noVNC/commit/ad941faddead705cd611921730054767a0b32dcd
- RHSA-2015:0788 vendor-advisory
- [oss-security] 20150312 CVE request: novnc: session hijack through insecurely set session token cookies mailing-list
- RHSA-2015:0834 vendor-advisory