Bug #19163
closed
Do not display the jetty version number
Description
For security reasons, it seems important to stop sending the Jetty version number.
All this in order to strengthen the security of Rudder (in case of pentest for example).
To disable the display of the version number:
jetty.send.server.version=false
Files
Updated by François ARMAND over 3 years ago
Can you be more precise where you want to hide it?
If it's in response header, AFAIK it's filtered out by apache, and so it's only viewable on localhost (and if you are localhost, you can already see much more with ps or whatever).
But, right, it's not a big deal to set the VM option (it's more to understand the criticity of the problem).
Updated by François ARMAND over 3 years ago
- Tracker changed from Architecture to Bug
- Priority set to 0
Updated by François ARMAND about 3 years ago
- Related to Bug #11160: We should not send Jetty version in header response added
Updated by François ARMAND about 3 years ago
Actually, we want to set the option by default in all case: there is no case where we want to send these informations, be it in local or not.
And we should remove the header rewrite from Apache config (from https://issues.rudder.io/issues/11160) to simplify things in a following minor.
Updated by Elaad FURREEDAN about 3 years ago
- Translation missing: en.field_tag_list changed from jetty to jetty, Sponsored
- File jetty_version.png jetty_version.png added
this refers to the version of jetty exposed on a 401 error page for example
Updated by Elaad FURREEDAN about 3 years ago
- Assignee set to Elaad FURREEDAN
- Target version changed from Ideas (not version specific) to 6.2.12
Updated by Elaad FURREEDAN about 3 years ago
- Status changed from New to In progress
Updated by Elaad FURREEDAN about 3 years ago
- Status changed from In progress to Pending technical review
- Assignee changed from Elaad FURREEDAN to Alexis Mousset
- Pull Request set to https://github.com/Normation/rudder-packages/pull/2554
Updated by Anonymous about 3 years ago
- Status changed from Pending technical review to Pending release
Applied in changeset rudder-packages|d8c3c161cbd49dfa6aacccaf43dab97d1e0fb046.
Updated by Alexis Mousset about 3 years ago
- Fix check changed from To do to Checked
Updated by Vincent MEMBRÉ about 3 years ago
- Status changed from Pending release to Released
This bug has been fixed in Rudder 6.2.12 and 7.0.0~rc2 which were released today.