Re: Vulnerability flagged in Nessus Scan

2020-06-03 Thread FANG YAP
Hi Martin, Thank you for your email. In my application's web.xml, there is already a default error-code that defines 404 (../error_404.jsp), 403 (../error_403.jsp), 500 (../error_500.jsp) and java.lang.Throwable (.. /system Error.jsp) where as the tomcat web.xml defines the previous error page

tomcat 9.0 doesn't load the ECDSA keystore. (ver # 9.0.24)

2020-06-03 Thread Madhan Raj
Hi All, OS - CentOS 7.6.1810( Core) Below connector doesn't load my EC keystore whereas it works with RSA . Any insights please . this is my connector tag in server.xml tomcat start up command used :- /home/tomcat/tomcat -user tomcat -home /usr/local/thirdparty/java/j2sdk -pidfile /usr/l

Re: Vulnerability flagged in Nessus Scan

2020-06-03 Thread John Palmer
As the concern is that an erro page will show the tomcat version/patch info AND a stacktrace,\ I found the easier/better? solution to be adding . showReport="false" showServerInfo="false" to the Error Report Valve section at the bottom of server.xml (and addin or or uncommenting that valve sect

Re: HTTP2 keepAliveTimeout changed from Infinite to 20 seconds (default)

2020-06-03 Thread Rémy Maucherat
Hi, On Wed, Jun 3, 2020 at 4:35 PM Arshiya Shariff wrote: > Hi Mark, > The keepAliveTimeout for HTTP2 , in the later tomcat versions is set to a > default value of 20 seconds and can be overridden . > Is there a reason that the keepAliveTimeout has been changed from infinite > to 20 seconds (def

HTTP2 keepAliveTimeout changed from Infinite to 20 seconds (default)

2020-06-03 Thread Arshiya Shariff
Hi Mark, The keepAliveTimeout for HTTP2 , in the later tomcat versions is set to a default value of 20 seconds and can be overridden . Is there a reason that the keepAliveTimeout has been changed from infinite to 20 seconds (default) . Were there any issues around this ? This is just for an info

Re: Vulnerability flagged in Nessus Scan

2020-06-03 Thread Martin Grigorov
On Wed, Jun 3, 2020 at 11:14 AM FANG YAP wrote: > Hello Martin, > > It is to say that I have to declare something like this in web.xml file? > > > java.lang.Exception > /error.jsp > Better use the error-code ones from the StackOverflow link I gave you. Your approach will cover only error code 5

Re: Vulnerability flagged in Nessus Scan

2020-06-03 Thread FANG YAP
Hello Martin, It is to say that I have to declare something like this in web.xml file? java.lang.Exception /error.jsp Regards with Thanks, Fang On Wed, 3 Jun 2020, 15:56 Martin Grigorov, wrote: > Hi, > > On Wed, Jun 3, 2020 at 5:53 AM FANG YAP wrote: > > > Resend > > > > On Wed, 3 Jun 2020

Re: Vulnerability flagged in Nessus Scan

2020-06-03 Thread Martin Grigorov
Hi, On Wed, Jun 3, 2020 at 5:53 AM FANG YAP wrote: > Resend > > On Wed, 3 Jun 2020, 10:10 FANG YAP, wrote: > > > Hi Tomcat, > > > > Nessus scanned and found issue in Apache Tomcat Port 8080 > > > > Port: 8080 > > Plugin Text: > > The server is not configured to return a custom page in the event

Re: mod_jk and application deployed check

2020-06-03 Thread Giuseppe Sacco
Il giorno ven, 29/05/2020 alle 14.09 -0400, Christopher Schultz ha scritto: > Giuseppe, > > On 5/29/20 11:57, Giuseppe Sacco wrote: > > [...] > > misconfigured machines and failed with 404 errors. From what I > > understood, the mod_jk protocol only allows to check it tomcat is > > alive. Is it po