Re: Re: Question regarding CVE applicability of missing HttpOnly flag

[Murray McAllister <mmcallis () redhat com>]

On 06/26/2014 05:38 PM, Henri Salo wrote:
> On Thu, Jun 26, 2014 at 05:30:46PM +1000, Murray McAllister wrote:
> > But websites set lots of cookies, which if stolen, have no relevance
> > to being able to access the user's session, or do much of anything
> > useful with anyway. I believe a lot of the "this cookie does not
> > have HTTPOnly" issues are non-issues.
>
> Those CVEs should be REJECTED. Can you provide list of non-issues with CVE?
>
> ---
> Henri Salo

I was not clear, sorry. I had not looked at the original CVEs, and was 
just talking in general: Red Hat has 
https://access.redhat.com/site/articles/66234 and we get a lot of 
httponly related reports (assuming others get them too).

Cheers,

--
Murray McAllister / Red Hat Product Security