Loading...

XML

Word

Printable

Story Points:
1
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Ready:
False
Docs Approval:
No Docs Impact
Fixed in Build:
openstack-operator-container-1.0.8-13
Regression:
None
Release Note Text:

Hide
.`TraceEnable` parameter disabled by default in httpd configuration
Before this update, HTTP TRACE was enabled by default from the `OpenStackProvisionServer` CR which resulted in security scanners creating an alert. With this update, the `TraceEnable` parameter has been set to the value "off" by default in the httpd configuration.

Show
.`TraceEnable` parameter disabled by default in httpd configuration Before this update, HTTP TRACE was enabled by default from the `OpenStackProvisionServer` CR which resulted in security scanners creating an alert. With this update, the `TraceEnable` parameter has been set to the value "off" by default in the httpd configuration.
Release Note Type:
Bug Fix
Release Note Status:
Done
Test Coverage:

Regression Only
Intelligence Requested:
Market:

Security scanner will alert on HTTP trace enabled.

To Reproduce Steps to reproduce the behavior:
HTTP TRACE is allowed from OSPDO provisioner server.

Expected behavior
TraceEnable Off in httpd config

Bug impact
Security issue as defined by the scanner

Known workaround
None; it seems the operator will revert any manual config

clones

OSPRH-14473 [17.1 OSPDO] - OpenStackProvisionServer should not allow HTTP TRACE

links to

mentioned on