CVE-2022-1655

Published: 22 July 2022

An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity.

Notes

Author	Note
mdeslaur	Red Hat packaging specific issue

Priority

Cvss 3 Severity Score

6.5

Score breakdown

Status

Package	Release	Status
horizon Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	focal	Not vulnerable
	impish	Ignored (end of life)
	jammy	Not vulnerable
	kinetic	Not vulnerable
	lunar	Not vulnerable
	upstream	Needs triage
	xenial	Not vulnerable

Severity score breakdown

Parameter	Value
Base score	6.5
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

Bugs

https://bugzilla.redhat.com/show_bug.cgi?id=2075681

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›