TqV8HaM@
A security scan of my Openvpn server reported the following, which i don't think applies to Openvpn , but I want to check and make sure.
As far as I know , Openvpn does not use https cache-control headers and so this vulnerability does not seem to apply.
This seems to only apply to https servers like Apache, nginx, Microsoft IIS, etc ....
I think it the vulnerabiliity scanner flagged it because it was expecting a cache-control response and didn't get one,
Does that sound right?
Here are the details
=====================
Medium Vulnerability: weak https cache policy
Reference ID: weak https cache policy
Reference Type: saint
Brief Description: The confidentiality provided by https sessions could be compromised due to stored copies of sensitive pages in a shared cache or browser cache.
Details:
Service: https
Sent:
GET / HTTP/1.0
Host: xxx.31.1.5
User-Agent: Mozilla/5.0
Received:
(no Cache-Control header)
Resolution:
Set the Cache-Control header to one or more of the following values: private, no-cache, no store
================================
There is not Openvpn setting for Cache-Control that I know , so nothing needs to be done. Does that sound right?
Thanks,
