This is an automated email from the ASF dual-hosted git repository.

mjumper pushed a commit to branch asf-site
in repository

The following commit(s) were added to refs/heads/asf-site by this push:
     new 33c637f  Deploy documentation of CVE-2018-1340.
33c637f is described below

commit 33c637fe777cb8dd81c84ddfd598251a8a6bf799
Author: Michael Jumper <>
AuthorDate: Wed Jan 23 14:52:25 2019 -0800

    Deploy documentation of CVE-2018-1340.
 content/security/index.html | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/content/security/index.html b/content/security/index.html
index a742e34..5eec905 100644
--- a/content/security/index.html
+++ b/content/security/index.html
@@ -421,6 +421,28 @@ mailing list of the <a 
href="";>ASF Security Team
 the <a 
mailing list, before disclosing or
 discussing the issue in a public forum.</p>
+<h2 id="fixed-in-apache-guacamole-100">Fixed in Apache Guacamole 1.0.0</h2>
+    <li>
+        <h3 id="CVE-2018-1340">
+            Secure flag missing from session cookie
+            (<a 
+        </h3>
+        <p>Prior to 1.0.0, Apache Guacamole used a cookie for client-side 
storage of the
+user’s session token. This cookie lacked the “secure” flag, which could allow
+an attacker eavesdropping on the network to intercept the user’s session token
+if unencrypted HTTP requests are made to the same domain.</p>
+<p>Acknowledgements: We would like to thank Ross Golder for reporting this 
+    </li>
 <h2 id="fixed-in-apache-guacamole-0911-incubating">Fixed in Apache Guacamole 

Reply via email to