VCST-70-000015 - The Security Token Service must be configured with memory leak protection.

Information

The Java Runtime environment can cause a memory leak or lock files under certain conditions. Without memory leak protection, the Security Token Service can continue to consume system resources which will lead to 'OutOfMemoryErrors' when reloading web applications.

Memory leaks occur when JRE code uses the context class loader to load a singleton. This this will cause a memory leak if a web application class loader happens to be the context class loader at the time. The 'JreMemoryLeakPreventionListener' class is designed to initialize these singletons when Tomcat's common class loader is the context class loader. Proper use of JRE memory leak protection will ensure the hosted application does not consume system resources and cause an unstable environment.

Solution

Navigate to and open:

/usr/lib/vmware-sso/vmware-sts/conf/server.xml

Navigate to the <Server> node.

Add '<Listener className='org.apache.catalina.core.JreMemoryLeakPreventionListener'/>' to the <Server> node.

Restart the service with the following command:

# vmon-cli --restart sts

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-256759r889247_rule, STIG-ID|VCST-70-000015, Vuln-ID|V-256759

Plugin: Unix

Control ID: ab2dfa76319ed90d375083a8c74d887e7346f1ab093ff80a1c96f802a402edf9