guacamole-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Chris Bradford <chrismbradf...@outlook.com>
Subject Re: Docker images scanned with OpenVAS :: NVT: Apache Tomcat servlet/JSP container default files
Date Thu, 25 May 2017 21:29:14 GMT
>> If you think you've found an issue which has security implications, *please do not
post it to the public lists*. Follow responsible disclosure practices [1] and contact us directly.

Considering what was reported I didn't figure it was a real concern. Had there been a genuine
issue (i.e. beyond default files being contained within the container) I'd have done as above.
Duly noted.


Sent from Nine<http://www.9folders.com/>
________________________________
From: Mike Jumper <mike.jumper@guac-dev.org>
Sent: 25 May 2017 9:12 pm
To: user@guacamole.incubator.apache.org
Subject: Re: Docker images scanned with OpenVAS :: NVT: Apache Tomcat servlet/JSP container
default files

Chris,

If you think you've found an issue which has security implications, *please do not post it
to the public lists*. Follow responsible disclosure practices [1] and contact us directly.

Regarding the issue at hand, I agree it's not overly concerning that the Guacamole webapp
image (which is based on the Tomcat image) contains the same default webapp present in the
Tomcat image, and wouldn't really consider this a vulnerability. If you are concerned about
the presence of the default webapp, you always remove it yourself by creating your own image
based on our image. You are also welcome to make and contribute changes to the Dockerfile
achieving this. Just follow our contribution guidelines:

https://github.com/apache/incubator-guacamole-client/blob/master/CONTRIBUTING

Thanks,

- Mike

[1] https://en.wikipedia.org/wiki/Responsible_disclosure


On Thu, May 25, 2017 at 12:27 PM, Chris Bradford <chrismbradford@outlook.com<mailto:chrismbradford@outlook.com>>
wrote:

When using OpenVAS <http://www.openvas.org/> to scan a Docker host (Ubuntu 16.04 LTS)
running the guacamole/guacd and guacamole/guacamole docker containers the vulnerability below
is detected.


Whilst not overly concerning, I was just wondering if at next release this can be addressed,
or am I missing something where I can do this myself at image pull/ run?


Thanks,


Chris


----------------------------------------------------------------------


NVT: Apache Tomcat servlet/JSP container default files
Config:
Family: Web Servers
OID:    1.3.6.1.4.1.25623.1.0.12085
Version:        $Revision: 4355 $


Summary

The Apache Tomcat servlet/JSP container has default files installed.

Vulnerability Scoring
CVSS base:
6.8

CVSS base vector:

Vulnerability Insight

Default files, such as documentation, default Servlets and JSPs were found on the Apache Tomcat
servlet/JSP container.

Vulnerability Detection Method

Quality of Detection: remote_vul (99%)

Impact

These files should be removed as they may help an attacker to guess the exact version of the
Apache Tomcat which is running on this host and may provide other useful information.

Solution

Solution type: [Mitigation]  Mitigation

Remove default files, example JSPs and Servlets from the Tomcat Servlet/JSP container.



Mime
View raw message