Description
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | cumin | 0.1.5796-4.el5_9 | RHSA-2014:0859, RHSA-2014:0858 |
Advisories 2
- RHSA-2014:0859 Red Hat Security Advisory: Red Hat Enterprise MRG 2.5 Messaging and Grid security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2014:0858 Red Hat Security Advisory: Red Hat Enterprise MRG 2.5 Messaging and Grid security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2014:0858 vendor-advisory
- RHSA-2014:0859 vendor-advisory