CVE-2015-1848: The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https sess...

Security readout for executives and security teams

pcsd did not mark an HTTPS session cookie as Secure. A browser could then send that cookie over HTTP, where someone able to intercept traffic might capture it. The bundle does not provide CVSS, exploitation evidence, or detailed product packaging beyond PCS 0.9.137 and earlier. Likely exposure is limited to environments running PCS/pcsd 0.9.137 or earlier, including Red Hat or Fedora systems covered by the cited advisories. Exposure depends on whether pcsd is deployed and whether cookies can traverse HTTP paths. Treat as a targeted administrative-plane hygiene issue. Prioritize remediation on cluster management hosts or systems where pcsd is reachable from untrusted networks, especially if legacy Red Hat or Fedora packages remain in use. Mitigation focus: Review the Red Hat and Fedora advisories for fixed package guidance.; Upgrade PCS/pcsd where vendor updates are available.; Restrict pcsd access to trusted administrative networks..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.