[ZOOKEEPER-3772] JettyAdminServer should not allow HTTP TRACE method

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.6.1, 3.5.8
• Fix Version/s: 3.5.9, 3.7.0, 3.6.2
• Labels: pull-request-available
• Assignee: Unassigned
• Reporter: Jinjiang Ling
• Created: 28/Mar/20 04:42
• Updated: 10/Sep/20 10:43
• Resolved: 05/May/20 07:22

Description

When I upgrade my zookeeper cluster to 3.5.7, a nessus scan pinged the cluster because the 8080 port of JettyAdminServer allows HTTP TRACE method.

Issue Links

• links to: GitHub Pull Request #1296
• links to: Github Pull Request #1349