CVE-2015-3207: Insecure cookies in Openshift Origin
Summary
CVE-2015-3207: Insecure cookies in Openshift Origin. Affects github.com/openshift/origin versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Openshift Origin is an open-source container application platform developed by Red Hat. It provides a platform for developing, deploying, and managing applications using containerization technology. The vulnerability in Openshift Origin involves the cookies set in the console, which do not have the 'secure' and 'HttpOnly' attributes. This makes the cookies susceptible to interception and manipulation by attackers.
Vulnerability Detail
The vulnerability in Openshift Origin allows an attacker to intercept and manipulate the cookies used in the console. By doing so, the attacker can potentially gain unauthorized access to the console and perform actions on behalf of the authenticated user. This can lead to various security risks, such as data theft, privilege escalation, and unauthorized modification of resources.
How To Fix
Latest published version: v1.6.2 as of 22 Oct 2026
go get github.com/openshift/origin@v1.6.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
go get github.com/openshift/origin@v1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A possible workaround for this vulnerability is to manually modify the cookie settings in the Openshift Origin codebase. Specifically, the code responsible for setting the cookies in the console should be updated to include the 'secure' and 'HttpOnly' attributes. Here is an example of how the code can be modified:
cookie := http.Cookie{
Name: "cookie_name",
Value: "cookie_value",
Secure: true,
HttpOnly: true,
}
http.SetCookie(w, &cookie)
By making these changes, the cookies will be more secure and less susceptible to interception and manipulation by attackers.
Conclusion
In summary, the vulnerability in Openshift Origin involves insecure cookies in the console, which can be intercepted and manipulated by attackers. To fix this vulnerability, the cookies should be configured with the 'secure' and 'HttpOnly' attributes. A possible workaround is to manually modify the cookie settings in the Openshift Origin codebase. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/openshift/origin →
FAQ
Openshift Origin is an open-source container application platform developed by Red Hat. It provides a platform for developing, deploying, and managing applications using containerization technology.
The vulnerability allows an attacker to intercept and manipulate the cookies used in the console, potentially gaining unauthorized access and performing actions on behalf of authenticated users. This can lead to data theft, privilege escalation, and unauthorized modification of resources.
To fix this vulnerability, the cookies in the console should be configured with the 'secure' and 'HttpOnly' attributes. This can be done by modifying the code responsible for setting the cookies in the Openshift Origin codebase.
Yes, a possible workaround is to manually modify the cookie settings in the Openshift Origin codebase to include the 'secure' and 'HttpOnly' attributes.
You can find more information about this vulnerability in the CVE-2015-3207 advisory and the Openshift Origin documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/openshift/origin.
