x/vulndb: potential Go vuln in github.com/openshift/origin: CVE-2015-3207

[GoVulnBot]

CVE-2015-3207 references github.com/openshift/origin, which may be a Go module.

Description:
In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.

Links:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2015-3207
• JSON: https://github.com/CVEProject/cvelist/tree/0b0d8a98d187771f7ab59c4af69387c2371b0a45/2015/3xxx/CVE-2015-3207.json
• PR: Use secure csrf/session cookies when serving on HTTPS openshift/origin#2291
• Imported by: https://pkg.go.dev/github.com/openshift/origin?tab=importedby
• https://bugzilla.redhat.com/show_bug.cgi?id=1221882

See doc/triage.md for instructions on how to triage this report.

packages:
  - module: github.com/openshift/origin
    package: Openshift Origin
description: |
    In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.
cves:
  - CVE-2015-3207
links:
    pr: https://github.com/openshift/origin/pull/2291
    context:
      - https://bugzilla.redhat.com/show_bug.cgi?id=1221882

[neild]

Publicly importable package github.com/openshift/origin/pkg/auth/server/session has zero imports known to pkg.go.dev, is clearly intended as an internal package. No other fixes to publicly importable packages. Vulnerability in tool, not a package intended for external use.

[gopherbot]

Change https://go.dev/cl/592768 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607219 mentions this issue: data/reports: unexclude 20 reports (17)