Re: Tomcat v9 - Insecure transport vulnerability reported by Qualys

2020-09-14 Thread Pratik Shrestha
Hi Guys, Just wanted to know if anyone found an idea on fixing it or a workaround. Thanks Pratik. On Fri, Aug 28, 2020 at 10:46 AM Pratik Shrestha wrote: > Hi Chris > > > > > *This wasn't the case for httpd for many years. I don't know what itdoes > these da

Re: Tomcat v9 - Insecure transport vulnerability reported by Qualys

2020-08-27 Thread Pratik Shrestha
Hi Chris *This wasn't the case for httpd for many years. I don't know what itdoes these days, but it used to reply with a nice "400 Bad Request"error just like Tomcat is doing. The difference is that httpd has richconfiguration options to allow you to override that behavior. * Correct. By defa

Re: Tomcat v9 - Insecure transport vulnerability reported by Qualys

2020-08-26 Thread Pratik Shrestha
Mark, > > On 8/26/20 13:59, Mark Thomas wrote: > > On 26/08/2020 17:50, Christopher Schultz wrote: > >> On 8/26/20 05:27, Mark Thomas wrote: > >>> On 26/08/2020 08:14, Martin Grigorov wrote: > >>>> Hi, > >>>> > >>>> On Wed, Au

Re: Tomcat v9 - Insecure transport vulnerability reported by Qualys

2020-08-25 Thread Pratik Shrestha
atik On Tue, Aug 25, 2020 at 5:36 PM Mark Thomas wrote: > On 25/08/2020 11:14, Pratik Shrestha wrote: > > Hi all, > > > > Tomcat version: 9.0.37 > > > > Our website is running on Tomcat. We did Qualys vulnerability scan on our > > site. Scan shows below vulne

Tomcat v9 - Insecure transport vulnerability reported by Qualys

2020-08-25 Thread Pratik Shrestha
Hi all, Tomcat version: 9.0.37 Our website is running on Tomcat. We did Qualys vulnerability scan on our site. Scan shows below vulnerability. Insecure transport Group: Information Disclosure CWE CWE-319 OWASP A3 Sensitive Data Exposure WASC WASC-4 INSUFFICIENT TRANSPORT LAYER PROTECTION Please