medium5.3
CVE-2019-19375
In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute.
Impact
In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The fix for this was backported to LTS versions 2019.6.14 and 2019.9.8.)
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Octopus | Octopus Deploy | before 2019.10.7 from 2019.6.0 before 2019.6.14 from 2019.9.0 before 2019.9.8 |