CABI Tomcat V-222975 - ErrorReportValve showServerInfo must be set to false

Products

• CA Spectrum
• DX NetOps

Issue/Introduction

The requirement was not met on Jasper server.

STIG Rule: V-222975 - ErrorReportValve showServerInfo must be set to false

Rule Title: ErrorReportValve showServerInfo must be set to false.

Discussion: The Error Report Valve is a simple error handler for HTTP status codes that will generate and return HTML error pages. It can also be configured to return pre-defined static HTML pages for specific status codes and/or exception types. Disabling showServerInfo will only return the HTTP status code and remove all CSS from the default non-error related HTTP responses.

Check Text: As an elevated user on the Tomcat server run the following command:

sudo grep -i ErrorReportValve $CATALINA_BASE/conf/server.xml file.

If the ErrorReportValve element is not defined and showServerInfo set to "false", this is a finding.

EXAMPLE:
<Host ...>
...
<Valve className="org.apache.catalina.valves.ErrorReportValve" showServerInfo="false"/>
...
</Host>

Fix Text: As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Create or modify an ErrorReportValve <Valve> element nested beneath each <Host> element.

EXAMPLE:
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="false">
...
<Valve className="org.apache.catalina.valves.ErrorReportValve"
showServerInfo="false" />
...
</Host>

Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload

Environment

Release : 21.2, 22.2

Component : Jaspersoft for CA Spectrum

Resolution

Raised Defect DE540346 for this to be added in a future release.

Manually update the server.xml file and add the ErrorReportValve


1. Change directory to the CABI tomcat conf folder

      cd /opt/CA/SharedComponents/CABI/apache-tomcat/conf/server.xml

2. Add the following just under the other AccessLogValve entry:

<Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false" showServerInfo="false"></Valve>

It should look something like this

3. Stop tomcat
      cd /opt/CA/SharedComponents/CABI/
      ./stopServers.sh tomcat

4. Start tomcat
      cd /opt/CA/SharedComponents/CABI/
      ./startServers.sh tomcat

 

 

 

Additional Information

V-222975 - ErrorReportValve showServerInfo must be set to false
https://stigviewer.com/stig/apache_tomcat_application_sever_9/2020-12-11/finding/V-222975


Verification: Access an invalid page on the CABI tomcat and verify that the 404 error does not report the tomcat version