Bug 1677767
| Summary: | Security issues flagging in cockpit - QID 11827 and QID 13162 | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Ryan Mullett <rmullett> | ||||
| Component: | cockpit | Assignee: | Martin Pitt <mpitt> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Jan Ščotka <jscotka> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 7.6 | CC: | cmuresan, rbarry, tbowling | ||||
| Target Milestone: | rc | Keywords: | Rebase | ||||
| Target Release: | 7.7 | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2019-08-06 13:11:28 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1657383 | ||||||
| Attachments: |
|
||||||
I had a déjà vu here, and indeed we had bug 1656339 a while ago about the HttpOnly attribute. So 2) is indeed completely harmless. The "real" cookie does have a "Security" flag, this only applies to the "deleted" variant on logout: HTTP Cookie missing Secure attribute on port 9090. Set-Cookie: cockpit=deleted; PATH=/ GET / HTTP/1.1 Host: <hostname>:9090 Connection: Keep-Alive I'll fix that to pacify the security scanner, but security-wise (even hardening) it's completely irrelevant. I'm not sure how to interpret 1): 2 port 9090/tcp HTTP Security Header Not Detected X-Frame-Options or Content-Security-Policy: frame-ancestors HTTP Headers missing on port 9090. GET / HTTP/1.1 Host: <hostname>:9090 Connection: Keep-Alive X-XSS-Protection HTTP Header missing on port 9090. X-Content-Type-Options HTTP Header missing on port 9090. Strict-Transport-Security HTTP Header missing on port 9090. So is this about restricting frame ancestors? We explicitly don't want to do that, as Cockpit pages should be embeddable/reusable by other projects/pages. See <https://cockpit-project.org/guide/latest/embedding.html>. Or is this about *all* of the mentioned headers? (Shouldn't these be separate issues?) Anyway, I'll go through these and see which are applicable. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options doesn't have an explicit "yes" to declare that embedding is intended, so we can't add that. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection doesn't buy us much. Cockpit has a very restrictive Content-Security-Policy and does not support old browsers (in the strong sense of "you can't log in, the login page will show an explanation about old browser"). Enabling this sounds very risky and requires thorough testing with lots of browsers and OSes, so this has a very bad benefit/risk ratio. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options seems moderately useful, we can test how well that works (and perhaps it detects a MIME declaration error somewhere). https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security seems very useful, and could harden Cockpit's built in handling of https → http degradation (currently that would just log you out and close your session, so it's already not bad). "Security" flag for deleted cookie: https://github.com/cockpit-project/cockpit/pull/11279 X-Content-Type-Options header: https://github.com/cockpit-project/cockpit/pull/11297 IMHO we shouldn't set Strict-Transport-Security (HSTS) in Cockpit. It wouldn't improve its own security, and only get in the way when users *actually* want to access it via http (which is configurable). So I think from the above we now have PRs/fixes for all the applicable ones. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2262 |
Created attachment 1535316 [details] Qualys results from sample system Description of problem: 1] HTTP Security Header Not Detected - QID 11827 2] Session Cookie Does Not Contain the "Secure" Attribute QID 13162 Version-Release number of selected component (if applicable): N/A How reproducible: Always Steps to Reproduce: N/A Actual results: N/A Expected results: N/A Additional info: - Spoke with product security about this issue, they responded with the following, and recommended opening a bug for this: ================================================================================ The customer is using Red Hat Virtualization 4.1 and the Qualys scanner flagged two issues against tcp 9090 which is used by cockpit. As far as I understand this, it seems to be a problem with cockpit not using HTTP Security header, as well as the session cookie not having the secure attribute. It's possible that these findings are correct, however, we can't tell if cockpit maintainers are aware and this was an informed decision on their part to not use these capabilities, or if this was an oversight and they can be added as a security hardening. In any case, I don't believe either of these issues are security vulnerabilities. These are both related to security hardening. I'd recommend raising a bug against cockpit, either in bugzilla or directly in their github. ================================================================================ - Attachment of Qualys results.