← Back to Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

V-221440

CAT II (Medium)

OHS must have the SSLSessionCacheTimeout directive set properly.

Rule ID

SV-221440r961863_rule

STIG

Oracle HTTP Server 12.1.3 Security Technical Implementation Guide

Version

V2R3

CCIs

CCI-000366

Discussion

During an SSL session, information about the session is stored in the global/inter-process SSL Session Cache, the OpenSSL internal memory cache and for sessions resumed by TLS session resumption (RFC 5077). This information must not be allowed to live forever, but expire and become invalid so that an attacker cannot hijack the session if not closed by the hosted application properly.

Check Content

1. As required, open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/ssl.conf with an editor.

2. Search for the "SSLSessionCacheTimeout" directive at the OHS server configuration scope.

3. If the directive is omitted or is set greater than 60, this is a finding.

Fix Text

1. Open $DOMAIN_HOME/config/fmwconfig/components/OHS/<componentName>/ssl.conf with an editor.

2. Search for the "SSLSessionCacheTimeout" directive at the OHS server configuration scope.

3. Set the "SSLSessionCacheTimeout" directive to "60", add the directive if it does not exist.