Peter Johnson [https://community.jboss.org/people/peterj] created the discussion "Re: JBOSS7: ASV Scan Report Attestation of Scan Compliance" To view the discussion, visit: https://community.jboss.org/message/739433#739433 -------------------------------------------------------------- You are using a community release. Community releases are "developer friendly". About the only security-related consideration for community edition is that  by default it connects to localhost, thus it will accept only traffic from that same PC. If you change that, then *you have to lock it down*. So the fact that there are security alerts is expected for a community release. The EAP releases, on the other hand, are locked down out-of-the-box. If a security scanner find problems with that, then I suspect the EAP team would want to hear about it . -------------------------------------------------------------- Reply to this message by going to Community [https://community.jboss.org/message/739433#739433] Start a new discussion in Beginner's Corner at Community [https://community.jboss.org/choose-container!input.jspa?contentType=1&...]

Carlos Oliva [https://community.jboss.org/people/ramboid] created the discussion "Re: JBOSS7: ASV Scan Report Attestation of Scan Compliance" To view the discussion, visit: https://community.jboss.org/message/739655#739655 -------------------------------------------------------------- Hi Peter, Could you mention areas for locking down and getting rid of the error?  Trying to identify these areas, it has been impossible to reproduce the error with the information in the error report.  In AS7 JIRA (AS7-4929), Darran Lofthouse reported his attempts to reproduce the error by issuing the requests that the report describes.  My Systems Manager is tryign to reach to the makers of the scanning tool and get more information.  We are waiting for their response.  It is difficult to fathom what else should be locked without further information. Could this be "a false positive"?  Darran explained to me that this error seems to belong to a different server, and that given the information at hand, Darran thought that it could be a "false positive".  Moreover, a google search on the main description of the error "myserver 1.2.0" revealed just one result for JBoss with a different scanner and it was deemed to be a "false positive". -------------------------------------------------------------- Reply to this message by going to Community [https://community.jboss.org/message/739655#739655] Start a new discussion in Beginner's Corner at Community [https://community.jboss.org/choose-container!input.jspa?contentType=1&...]