CVE-2015-1848: Fedora Pacemaker Configuration System

Medium severity, CVSS 6.8. EPSS: 2.4% chance of exploitation in the next 30 days.

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.

Affected products

• Fedora Pacemaker Configuration System: up to and including 0.9.137
• Red Hat Enterprise Linux High Availability: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux High Availability Eus: version 6.6.z only; version 7.1 only
• Red Hat Enterprise Linux Resilient Storage: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Resilient Storage Eus: version 6.6.z only; version 7.1 only

Published 2015-05-14. Last modified 2026-06-17.