Bug 1216035 (CVE-2015-3155)

Summary:	CVE-2015-3155 foreman: the _session_id cookie is issued without the Secure flag
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abaron, aortega, apevec, ayoung, bkearney, chrisw, cpelland, cperry, dallan, gkotton, gmollett, katello-bugs, lhh, lpeer, markmc, mburns, mmccune, ohadlevy, rbryant, rhos-maint, sclewis, tjay, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was found that Foreman did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-02-22 03:05:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1215622
Bug Blocks:	1145400, 1216038, 1253077

Description Vasyl Kaigorodov 2015-04-28 11:57:51 UTC

It was reported that the _session_id cookie in Foreman is set without the Secure flag.
This may allow an attacker to perform a "session hijacking" attack.

Upstream bug: http://projects.theforeman.org/issues/10275
Proposed fix: https://github.com/theforeman/foreman/pull/2328

Comment 1 Vasyl Kaigorodov 2015-04-29 15:48:03 UTC

Acknowledgements:

Red Hat would like to thank Rufus Järnefelt of Coresec for reporting this issue.

Comment 2 errata-xmlrpc 2015-08-12 04:52:09 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.1

Via RHSA-2015:1591 https://access.redhat.com/errata/RHSA-2015:1591

Comment 3 errata-xmlrpc 2015-08-12 05:30:57 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.1

Via RHSA-2015:1592 https://access.redhat.com/errata/RHSA-2015:1592