CVE-2015-3207: Missing Encryption of Sensitive Data

July 8, 2022 (updated July 15, 2022)

In Openshift Origin 3 the cookies being set in console have no ‘secure’, ‘HttpOnly’ attributes.

References

bugzilla.redhat.com/show_bug.cgi?id=1221882
github.com/advisories/GHSA-rqph-25q9-9jhp
github.com/openshift/origin/pull/2261
github.com/openshift/origin/pull/2291
nvd.nist.gov/vuln/detail/CVE-2015-3207

Detect and mitigate CVE-2015-3207 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →