Vulnerability Bulletins |
IBM Security Bulletin:Missing Secure Attribute in Encrypted Session (SSL) in InfoSphere BigInsights (CVE-2014-0905) |
|
| Affected software | IBM |
|
A secure flag (attribute) for the LTPA cookie is not set for SSL (https) sessions. Not having this flag prevents browser clients from ensuring that the cookie is always encrypted when transmitting from client to server. CVE(s): CVE-2014-0905 Affected product(s) and affected version(s): IBM InfoSphere BigInsights Versions 2.0 through 2.1.2 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: More info: https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_missing_secure_attribute_in_encrypted_session_ssl_in_infosphere_biginsights_cve_2014_0905?lang=en_us |
|