Description
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | pcs +1 | 0.9.137-13.el7_1.2 | RHSA-2015:0980 |
| RHEL 6 | pcs | 0.9.123-9.el6_6.2 | RHSA-2015:0990 |
Advisories 2
- RHSA-2015:0990 Red Hat Security Advisory: pcs security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2015:0980 Red Hat Security Advisory: pcs security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2015:0990 vendor-advisory
- FEDORA-2015-8761 vendor-advisory
- https://bugzilla.redhat.com/attachment.cgi?id=1009855
- RHSA-2015:0980 vendor-advisory
- FEDORA-2015-8765 vendor-advisory
- FEDORA-2015-8788 vendor-advisory
- 74682 vdb-entry