Tools

Remove the embedded Tomcat version from the error message

This article describes how to remove the version string from Tomcat HTTP error messages by repackaging the catalina.jar with an updated ServerInfo.properties file.

First published date

10/18/2018 9:31 AM

Last published date

12/23/2019 3:59 PM

Overview

There are instances that the generic server error that shows the version of Tomcat has to be obscured, such as for PCI compliance. This article describes how to remove the version string from Tomcat HTTP error messages by repackaging the catalina.jar file with an updated ServerInfo.properties file.

Product section

Web Help Desk

Resolution

Go to <WHD_INSTAL_DIR>/bin/tomcat/lib.

Run the following command to unpack the catalina.jar file:

jar xf catalina.jar org/apache/catalina/util/ServerInfo.properties

Update the ServerInfo.properties file by changing the server.info line to server.info=Apache Tomcat.
Run the following command to repackage the catalina.jar file:
```
jar uf catalina.jar org/apache/catalina/util/ServerInfo.properties
```
Remove <WHD_INSTAL_DIR>/bin/tomcat/lib/org. This file was created when the ServerInfo.properties file was extracted.
Restart WHD.

PS: The Tomcat version vulnerability has been addressed in Web Help Desk version 12.7. The resolution above is only applicable for Web Help Desk version 12.6 and lower.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.