Detections
Analytics

VCPF-80-000124 The vCenter Perfcharts service must enable 'STRICT_SERVLET_COMPLIANCE'.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Strict Servlet Compliance forces Tomcat to adhere to standards specifications including but not limited to RFC2109. RFC2109 sets the standard for HTTP session management. This setting affects several other settings that primarily pertain to cookie headers, cookie values, and sessions. Cookies will be parsed for strict adherence to specifications.

Note that changing a number of these default settings may break some systems, as some browsers are unable to correctly handle the cookie headers that result from a strict adherence to the specifications.

This one setting changes the default values for the following settings:

org.apache.catalina.core.ApplicationContext.GET_RESOURCE_REQUIRE_SLASH
org.apache.catalina.core.ApplicationDispatcher.WRAP_SAME_OBJECT
org.apache.catalina.core.StandardHostValve.ACCESS_SESSION
org.apache.catalina.session.StandardSession.ACTIVITY_CHECK
org.apache.catalina.session.StandardSession.LAST_ACCESS_AT_START
org.apache.tomcat.util.http.ServerCookie.ALWAYS_ADD_EXPIRES
org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR
org.apache.tomcat.util.http.ServerCookie.PRESERVE_COOKIE_HEADER
org.apache.tomcat.util.http.ServerCookie.STRICT_NAMING
The "resourceOnlyServlets" attribute of any Context element.
The "tldValidation" attribute of any Context element.
The "useRelativeRedirects" attribute of any Context element.
The "xmlNamespaceAware" attribute of any Context element.
The "xmlValidation" attribute of any Context element.

Solution

Navigate to and open:

/usr/lib/vmware-perfcharts/tc-instance/conf/catalina.properties

Add or change the following line:

org.apache.catalina.STRICT_SERVLET_COMPLIANCE=true

Restart the service with the following command:

# vmon-cli --restart perfcharts

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_8-0_Y24M08_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-259085r961863_rule, STIG-ID|VCPF-80-000124, Vuln-ID|V-259085

Plugin: Unix

Control ID: e01e5d26eb038c40b452dbcb49d384bf3ea792e642c69c5089053b44e8d95746