DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=31758>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=31758 Tomcat version number in error messages Summary: Tomcat version number in error messages Product: Tomcat 5 Version: 5.0.28 Platform: All OS/Version: All Status: NEW Severity: Normal Priority: Other Component: Catalina AssignedTo: [EMAIL PROTECTED] ReportedBy: [EMAIL PROTECTED] There was a "bug" fixed in the apache webserver somewhere back in 1.3 (maybe 1.3.26 or so) to hide the exact version number in error messages. Has there been any consideration to doing the same in Tomcat? The reason for the change was that in knowing the exact version, a hacker might be able to exploit a vulnerability known in that particular version. I know there are ways to hide the exact version by creating custom errorLogValves and such, but it seems I should have to. Also, I am not sure what all classes I need to override to get rid of all the version numbers. This may seem a minor point, but security folks love to make big issues out of minor points like this. I am not sure which Tomcat component this falls into, probably several since many things handle their own error messages --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
