(RHSA-2015:0884) Moderate: novnc security update

2015-04-2300:00:00

access.redhat.com

0.004 Low

EPSS

Percentile

74.7%

JSON

The novnc package provides a VNC client that uses HTML5 (Web Sockets,
Canvas) and includes encryption support.

It was discovered that noVNC did not properly set the ‘secure’ flag when
issuing cookies. An attacker could use this flaw to intercept cookies via a
man-in-the-middle attack. (CVE-2013-7436)

All novnc users are advised to upgrade to this updated package, which
corrects this issue.

OSVersionArchitecturePackageVersionFilename
RedHat6srcnovnc< 0.5.1-2.el6ostnovnc-0.5.1-2.el6ost.src.rpm
RedHat6noarchnovnc< 0.5.1-2.el6ostnovnc-0.5.1-2.el6ost.noarch.rpm