10.7 Turn off session facade recycling

Information

The RECYCLE_FACADES can specify if a new facade will be created for each request. If a new facade is not created there is a potential for information leakage from other sessions.

Solution

Start Tomcat with RECYCLE_FACADES set to true. Add the following to your startup script:
-Dorg.apache.catalina.connector.RECYCLE_FACADES=true

See Also

https://workbench.cisecurity.org/files/266

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: Unix

Control ID: 1e52dced26f8b28ffd18b3745418e7ce40fce66a98966209161f346be50cf45e