Bug 1371807 – CVE-2016-6344 JBoss bpms 6.3.x cookie does not set httponly

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1371807 - (CVE-2016-6344) CVE-2016-6344 JBoss bpms 6.3.x cookie does not set httponly

Summary:	CVE-2016-6344 JBoss bpms 6.3.x cookie does not set httponly

Status:	CLOSED ERRATA

Aliases:	CVE-2016-6344

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20160831,reported=2...
Keywords:	Security

Depends On:
Blocks:	1372095 1372135 1412839
	Show dependency tree / graph

Reported:	2016-08-31 03:23 EDT by Jeremy Choi
Modified:	2017-02-06 14:42 EST (History)
CC List:	15 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	It was discovered that JBoss BRMS 6 and BPM Suite 6 are not setting HttpOnly flags on sensitive cookies. Remote attackers can access these cookies by using client-side scripts, usually through XSS.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-02-06 14:42:06 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2017:0248	normal	SHIPPED_LIVE	Moderate: Red Hat JBoss BRMS security update	2017-02-02 20:33:45 EST
Red Hat Product Errata	RHSA-2017:0249	normal	SHIPPED_LIVE	Moderate: Red Hat JBoss BPM Suite security update	2017-02-02 20:33:32 EST

Groups: None (edit)

Description Jeremy Choi 2016-08-31 03:23:04 EDT

Cookies including JSESSIONID does not set httponly, so attackers may be able to access information which needs authentication using them.

Comment 1 Jeremy Choi 2016-08-31 03:23:19 EDT

Acknowledgments:

Name: Jeremy Choi (Red Hat Product Security Team)

Comment 4 errata-xmlrpc 2017-02-02 15:43:10 EST

This issue has been addressed in the following products:

  Red Hat JBoss BPM Suite 6.4.1

Via RHSA-2017:0249 https://rhn.redhat.com/errata/RHSA-2017-0249.html

Comment 5 errata-xmlrpc 2017-02-02 15:44:08 EST

This issue has been addressed in the following products:

  Red Hat JBoss BRMS 6.4.1

Via RHSA-2017:0248 https://rhn.redhat.com/errata/RHSA-2017-0248.html

Note You need to log in before you can comment on or make changes to this bug.