Disable HTTP Trace on gerrit

[lingalugari mohankrishna]

 Hi Experts,

We have a security team which scans all the servers and raises standard vulnerabilities. We got a vulnerability for gerrit server that it supports HTTP "TRACE" method. Currently we are on 3.6.8 version

Any idea on how to disable it on F5 ?  why gerrit has a support of TRACE method ?

Regards,
Mohan. L

[Matthias Sohn]

You can disable it e.g. by editing the application's web.xml file, see [1].

[1] https://stackoverflow.com/questions/59070434/how-to-disable-http-options-method-in-jetty-server

 

Regards,
Mohan. L

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/repo-discuss/7c487749-dda8-4bea-9760-561adfabba18n%40googlegroups.com.

[Maria Helena Braga]

Hi Mohan. L 

Were you able to disable the TRACE? 

Could you please describe how you did it? I need to do the same but I'm having issues... I tried Matthias suggestion to edit the web.xml file but it didn't disable the TRACE for me. 

I also tried to limit the methods via Nginx, but it also wasn't successfull.

Thanks, 

Maria H.

[lingalugari mohankrishna]

Hello Helena,

We have F5 as a Load balancer and we have created  separate i-Rule to block TRACE Requests. Even modifying web.xml didn't worked for me.

Regards,
Mohan. L