CVE:CVE-2015-1848
CNNVD:CNNVD-201505-227
PCS是ClusterLabs开源的一个 Corosync 和 Pacemaker 配置工具。
PCS 0.9.137版本及之前版本存在加密问题漏洞，该漏洞源于程序没有为https会话中的cookie设置安全标志。远程攻击者利用该漏洞通过拦截http会话中cookie的传输捕获该cookie。
solution:Upgrade fedora pacemaker_configuration_system to a higher version than 0.9.137,and avoid the version (,0.9.137]; Upgrade redhat enterprise_linux_high_availability to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_high_availability_eus to a higher version than 6.6.z,7.1,and avoid the version 6.6.z,7.1; Upgrade redhat enterprise_linux_resilient_storage to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_resilient_storage_eus to a higher version than 6.6.z,7.1,and avoid the version 6.6.z,7.1