CVE-2015-3983: The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header,...

Security readout for executives and security teams

CVE-2015-3983 is a cookie-protection weakness in the pcs daemon, pcsd, in PCS 0.9.137 and earlier. Because the cookie lacked the HTTPOnly flag, browser-side scripts could read it, increasing the chance that sensitive session information could be stolen if script execution was possible. Exposure is most likely on systems running PCS 0.9.137 or earlier with pcsd enabled. The supplied sources reference Red Hat and Fedora advisories, but the bundle does not provide exact fixed package versions or platform-specific applicability details. Treat this as a targeted remediation item for environments using PCS clustering administration. It is not evidenced as actively exploited in the provided sources, but it can weaken session protection and should be resolved through vendor updates. Mitigation focus: Check Red Hat and Fedora advisories for the fixed PCS or pcsd package versions.; Update affected PCS installations through the supported vendor package channel.; If updates are unavailable, request vendor-supported mitigation guidance..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.