HAProxy files must be verified for their integrity (checksums) before being added to the build systems.

From VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide

Associated with: CCI-001749

SV-99799r1_rule HAProxy files must be verified for their integrity (checksums) before being added to the build systems.

Vulnerability discussion

Being able to verify that a patch, upgrade, certificate, etc., being added to the web server is unchanged from the producer of the file is essential for file validation and non-repudiation of the information.The HAProxy web server files on vRA must be part of a documented build process. Checksums of the production files must be available to verify their integrity.

Check content

Interview the ISSO. Determine whether web server files are verified/validated before being implemented into the production environment. If the web server files are not verified or validated before being implemented into the production environment, this is a finding.

Fix text

Ensure web server files are verified or validated before being implemented the production environment.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.