CVE-2015-3155

Vulnerabilidad en Foreman en versiones anteriores a 1.8.1, no configura el indicador de seguridad para la cookie the _session_id en una sesión https, lo que facilita a atacantes remotos capturar esta cookie interceptando su transmisión dentro de una sesión http.

It was found that Foreman did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie.

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning and configuration management of predefined standard operating environments. This update provides Satellite 6.1 packages for Red Hat Enterprise Linux 7. It was discovered that in Foreman the edit_users permissions allowed the user to edit admin user passwords. An attacker with the edit_users permissions could use this flaw to access an admin user account, leading to an escalation of privileges.