Graylog2 / Graylog2/graylog2-server

Minor security improvement: Prevention of software version exposure

Open
#9,934 0 comments 0 reactions 0 assignees View on GitHub
improvement security triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

We are running Graylog 3.3.8 in a project and recently made a security scan looking for vulnerabilities.
The scans showed that under the following endpoints...
/api/system
/api/system/jvm
/assets/builtins.4678e54c30f1075e4dd8.js
/assets/plugin/org.graylog.aws.AWSPlugin/plugin.org.graylog.aws.AWSPlugin.f2cd3046f5d8c08ce593.js
/api/

... information about the used software versions can be retrieved:
Generic: 3.3.8+e223f85
Linux: 3.10.0-1127.13.1.el7.x86_64
Oracle Java: 5
Underscore.js: 1.8.3

As the knowledge about used software versions potentially offers the chance to plan attacks against the software, I am reporting these insights so that security can be improved. This is of course a minor topic, even though the report is hopefully helpful to improve Graylog.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.