TCAT-AS-000920 - ErrorReportValve showServerInfo must be set to false.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Error Report Valve is a simple error handler for HTTP status codes that will generate and return HTML error pages. It can also be configured to return pre-defined static HTML pages for specific status codes and/or exception types. Disabling showServerInfo will only return the HTTP status code and remove all CSS from the default non-error related HTTP responses.

Solution

As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Create or modify an ErrorReportValve <Valve> element nested beneath each <Host> element.

EXAMPLE:
<Host name='localhost' appBase='webapps'
unpackWARs='true' autoDeploy='false'>
...
<Valve className='org.apache.catalina.valves.ErrorReportValve'
showServerInfo='false' />
...
</Host>

Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Tomcat_Application_Server_9_V2R4_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001312, Rule-ID|SV-222975r615938_rule, STIG-ID|TCAT-AS-000920, STIG-Legacy|SV-111473, STIG-Legacy|V-102533, Vuln-ID|V-222975

Plugin: Unix

Control ID: 08547693664153a9dcc417ef79b323a61528e396ef471acc2e5eb9722cd292fe