Description Florian Best 2023-01-18 11:55:22 CET

A security scan by a customer wants to disable the cherrypy version disclosure.
While our source is open source and one can just lookup the used cherrypy versions easily, this doesn't improve any security but helps we don't get such reports anymore. Therefore we should disable it.

"""
CherryPy web server version disclosure (ASVS:14.3.3)

This RISK does not introduce a vulnerability by itself. The headers can be used to help identify security flaws which may exist as a result of the choice of technology exposed in these headers. This facilitates further steps.

Request:
GET /univention/saml/iframe/ HTTP/1.1
Response:
HTTP/1.1 302 Found
Date: Wed, 26 Feb 2020 14:04:49 GMT
Server: CherryPy/3.5.0
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: master-only
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Length: 6587
Content-Type: text/html;charset=utf-8
"""

while we are at it we can also improve the cherrypy startup and general performance by deactivating the startup checkers and exclude the possibility to mount WSGI applications.