Vulnerability scan flags HTTP/1.1 protocol on port 443 - Endpoint Protection Manager

Products

• Endpoint Protection

Issue/Introduction

A Vulnerability Assessment (VA) scan report flags the HTTP/1.1 protocol on port 443 as vulnerable to request smuggling or HTTP desync attacks. This occurs on systems running Symantec Endpoint Protection Manager (SEPM). The scan often recommends upgrading to HTTP/2.

Environment

• Symantec Endpoint Protection Manager 14.3 RU9, 14.3 RU10
• Apache HTTP Server
• Apache Tomcat

Cause

VA scanners often flag the HTTP/1.1 protocol generically due to potential Request Smuggling or Desync vulnerabilities. These tools may not account for specific security mitigations implemented in the underlying web server components.

Resolution

Symantec Endpoint Protection Manager is not vulnerable to these protocol-level attacks in current versions. The underlying components are updated to versions that strictly enforce header precedence, effectively mitigating HTTP desync risks.

SEPM versions 14.3 RU9 and 14.3 RU10 include the following remediated components:

• SEPM 14.3 RU9: Apache 2.4.59 / Tomcat 9.0.83
• SEPM 14.3 RU10: Apache 2.4.62 / Tomcat 9.0.98

These versions strictly enforce precedence for the Transfer-Encoding: chunked header during dual-header requests. An upgrade to HTTP/2 is not required for remediation.