topic Re: HSTS Missing From HTTPS Server - Serv in General Topics

HSTS Missing From HTTPS Server - Serv

keydee — Sat, 26 Sep 2020 15:13:37 GMT

Our checkpoint gateways is hosted in google cloud environment which uses r80.10. This is our first time to encounter an "HSTS Missing From HTTPS Server" vulnerability which came from the result of our vulnerability scanner. It targets the service 443 which I assume more on the gaia web. Could you kindly assist me on how can I find the configuration of this HSTS in either management server or gateway. Has anyone also tried to fix this in your checkpoint that are hosted also in a cloud environment.

Re: HSTS Missing From HTTPS Server - Serv

PhoneBoy — Mon, 28 Sep 2020 04:28:07 GMT

Install the latest jumbo hotfix, which includes this configuration, or upgrade to a later version.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk121795

Re: HSTS Missing From HTTPS Server - Serv

_Val_ — Mon, 28 Sep 2020 07:27:39 GMT

Missing HSTS is a cosmetic issue here. Gaia only allows HTTPS TLS connectivity in any case. However, if you want it fixed, please follow @PhoneBoy's directions