https://bugzilla.redhat.com/show_bug.cgi?id=1806398
--- Comment #7 from Doran Moppert <dmoppert(a)redhat.com> ---
Mitigation:
The issue can be mitigated as follows:
1. If your site is not actively using the AJP Connector, simply comment it out
from the /conf/server.xml file as
~~~
<!-- <Connector port = "8009" protocol = "AJP / 1.3"
redirectPort = "8443" />
-->
~~~
2. If AJP connector is a requirement and cannot be commented/deactivated, then,
it is recommended to configure requiredSecret for the AJPConnector to set the
AJP protocol authentication credentials. For example (note that
YOUR_TOMCAT_AJP_SECRET must be changed to a value that is highly secure and
cannot be easily guessed):
~~~
<Connector port = "8009"
protocol = "AJP / 1.3"
redirectPort = "8443"
address = "YOUR_TOMCAT_IP_ADDRESS"
requiredSecret = "YOUR_TOMCAT_AJP_SECRET" />
~~~
--
You are receiving this mail because:
You are on the CC list for the bug.