[datagov-brokerpak-solr] ALB does not drop invalid headers

[nickumia-reisys]

Date of report: 12/06/2022
Severity: Low

Due date is based on severity and described in RA-5. 15-days for Critical, 30-days for High, and 90-days for Moderate and lower.

• ALB does not drop invalid headers (Low)
  • Detailed paths
    • Path: terraform/ecs/provision/lb-follower.tf
    • Introduced through: resource › aws_lb[solr-follower]
  • This issue is...
    • The application load balancer is not set to drop invalid headers.
  • The impact of this is...
    • Maliciously crafted headers may be accepted by the load balancer
  • You can resolve it by...
    • Set drop_invalid_header_fields to true
• ALB does not drop invalid headers (Low)
  • Detailed paths
    • Path: terraform/ecs/provision/lb-leader.tf
    • Introduced through: resource › aws_lb[solr]
  • This issue is...
    • The application load balancer is not set to drop invalid headers.
  • The impact of this is...
    • Maliciously crafted headers may be accepted by the load balancer
  • You can resolve it by...
    • Set drop_invalid_header_fields to true

[nickumia-reisys]

Superseded by

• [Snyk] ALB does not drop invalid headers GSA-TTS/datagov-brokerpak-solr#78