Description
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | pcs +1 | 0.9.137-13.el7_1.2 | RHSA-2015:0980 |
| RHEL 6 | pcs | 0.9.123-9.el6_6.2 | RHSA-2015:0990 |
Advisories 2
- RHSA-2015:0990 Red Hat Security Advisory: pcs security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2015:0980 Red Hat Security Advisory: pcs security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2015:0990 vendor-advisory
- FEDORA-2015-8761 vendor-advisory
- https://bugzilla.redhat.com/attachment.cgi?id=1009855
- RHSA-2015:0980 vendor-advisory
- FEDORA-2015-8765 vendor-advisory
- FEDORA-2015-8788 vendor-advisory
- 74623 vdb-entry