freeipa

#9897 Server version information disclosure
Closed: fixed by dhanina. Opened by snegrini.

Closed: fixed
Reopen Issue

During a recent OWASP ZAP scan of the FreeIPA WebUI, a low-risk configuration issue was identified.
The HTTP response header Server disclosing detailed version information about the underlying server software. For example:

Server: Apache/2.4.65 (Fedora Linux) OpenSSL/3.5.4 mod_wsgi/5.0.2 Python/3.14 mod_auth_gssapi/1.6.5

This level of detail is unnecessary for application function and provides potential attackers with valuable reconnaissance information. Knowing the specific software versions (Apache, OpenSSL, OS, ...) allows attackers to identify and target known vulnerabilities for those components.

CWE: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Recommendation
Suppress the Server header in the web server's configuration to prevent the disclosure of detailed software and version information.

Metadata Update from @dhanina:
- Issue assigned to dhanina

Metadata Update from @dhanina:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8335

master:

  • fa2b817b00dadaeccabca896ffc0c7bc9712a4c9 Disallow retrieving software versions

ipa-4-8:

  • e842946324ee160f32cd34321f8b625aef9cb766 Disallow retrieving software versions

ipa-4-6:

  • d35ff259d1f8f3e0841a4d61d18c99e06e7236c8 Disallow retrieving software versions

Metadata Update from @dhanina:
- Custom field rhbz adjusted to https://redhat.atlassian.net/browse/IDM-1603

ipa-4-12:

  • 0a7e6af6a840fed8383519345686c3cf1646b56f Disallow retrieving software versions

ipa-4-11:

  • 7ce1fb4e81daaf6c4ab2148e56b986ed6a7fefdc Disallow retrieving software versions

ipa-4-9:

  • df71941bed9152c8ca02e0de82a6504f6c884e6c Disallow retrieving software versions

ipa-4-10:

  • 5ba9b831fd8af3387ea71ad6cc14f0022bff5e58 Disallow retrieving software versions

ipa-4-13:

  • a0fce96da3c11a8ad1e7d7bb8cef087a74a56252 Disallow retrieving software versions

Metadata Update from @dhanina:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/8335
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.