securityjenkinsjettyhttp-status-code-404crlf-vulnerability

Custom page for HTTP 404 page URL in Jenkins


My Jenkins is running on https://myhost:9043 using the standalone war on Linux with the below command.

java -jar jenkins.war

However, when I try the following URL for say https://myhost:9043/<any random text> the resource uri is obviously not found.

The problem, however, is I get output in the browser as

HTTP 404 error URI not found Powered by Jetty://9.4.27.vXXXX

I wish not to reveal the Jetty version.

Is there a way to display a custom error page for incorrect URIs thus avoiding revealing the Jetty version? If not, can I somehow hide the Jetty version from being displayed to anonymous users?

I'm not a pure java programmer but just a DevOps admin.


Solution

  • You can override the Jetty version with adding to your command line -Djetty.version=NOTHING Otherwise I created the issue https://issues.jenkins-ci.org/browse/JENKINS-62890 to have a custom error page from users