Bug #19163
closed
Do not display the jetty version number
Added by Julien BRIAULT over 3 years ago.
Updated over 2 years ago.
Effort required:
Very Small
Description
For security reasons, it seems important to stop sending the Jetty version number.
All this in order to strengthen the security of Rudder (in case of pentest for example).
To disable the display of the version number:
jetty.send.server.version=false
Files
Can you be more precise where you want to hide it?
If it's in response header, AFAIK it's filtered out by apache, and so it's only viewable on localhost (and if you are localhost, you can already see much more with ps or whatever).
But, right, it's not a big deal to set the VM option (it's more to understand the criticity of the problem).
- Tracker changed from Architecture to Bug
- Priority set to 0
- Related to Bug #11160: We should not send Jetty version in header response added
Actually, we want to set the option by default in all case: there is no case where we want to send these informations, be it in local or not.
And we should remove the header rewrite from Apache config (from https://issues.rudder.io/issues/11160) to simplify things in a following minor.
this refers to the version of jetty exposed on a 401 error page for example
- Assignee set to Elaad FURREEDAN
- Target version changed from Ideas (not version specific) to 6.2.12
- Status changed from New to In progress
- Status changed from In progress to Pending technical review
- Assignee changed from Elaad FURREEDAN to Alexis Mousset
- Pull Request set to https://github.com/Normation/rudder-packages/pull/2554
- Status changed from Pending technical review to Pending release
- Fix check changed from To do to Checked
- Status changed from Pending release to Released
This bug has been fixed in Rudder 6.2.12 and 7.0.0~rc2 which were released today.
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by Anonymous 
Updated by 
Updated by 