Anchore STIG Profiles Release Notes - 2026-11-11

Anchore STIG Profiles - 2026-11-11

apache-tomcat-9 now implements the DISA Apache Tomcat Application Server 9 STIG V3R5, ubuntu2204 the DISA Canonical Ubuntu 22.04 LTS STIG V2R10, and ubuntu2404 the DISA Canonical Ubuntu 24.04 LTS STIG V1R7. The profiles published before this update implemented V3R2 (apache-tomcat-9 3.2.0), V1R1 (ubuntu2204 1.0.0) and V1R2 (ubuntu2404 1.1.0), so this update also includes the changes from the DISA releases in between (Tomcat 9 V3R3 and V3R4, Ubuntu 22.04 V2R1 to V2R9, Ubuntu 24.04 V1R3 to V1R6). The update was published through the Anchore Data Service on 2026-11-11. Anchore Enterprise deployments receive it at their next feed sync. Air-gapped deployments receive it when they next download and import the datasets.

Updated Profiles

Changes

• apache-tomcat-9 has 79 controls (was 82). Removed SV-222927, SV-222929 and SV-222936, which DISA removed in V3R3.
• ubuntu2204 has 191 controls (was 183). Added SV-274860, SV-274861, SV-274862, SV-274864, SV-274865, SV-274866, SV-274867, SV-278951, SV-279937, SV-288815, SV-288816 and SV-288817. Removed SV-260468, SV-260544, SV-260551 and SV-260568, which are not in V2R10.
• ubuntu2404 has 195 controls (was 194). Added SV-278917, SV-279938, SV-288818 and SV-288819. Removed SV-270694, SV-270710 and SV-270774, which are not in V1R7.
• More ubuntu2204 and ubuntu2404 controls now report Not Applicable in container images. Besides checks of running services, the kernel, boot settings and loaded audit rules, this includes some checks of the image’s packages and files, such as whether auditd, chrony, AppArmor, a firewall or vlock is installed, the ownership of /var/log/syslog, and NOPASSWD rules in sudoers (SV-274860, SV-274868). On the official ubuntu:22.04 image, 27 existing controls change to Not Applicable, 17 of which failed before. On ubuntu:24.04, 39 change, 26 of which failed before. SSH controls still run when the image includes openssh-server, and some sudo and journal controls run when the image includes sudo or journalctl.
• ubuntu2204 now also runs on Debian 12 images and ubuntu2404 on Debian 13 images. Earlier versions did not run on them: AnchoreCTL reported an unsupported platform. The DISA STIGs these profiles implement are for Ubuntu.
• apache-tomcat-9 has a new input, catalina_home, for the Tomcat installation directory. SV-222947, SV-222948, SV-222986, SV-222996, SV-222998 and SV-223000 now read it: DISA checks $CATALINA_HOME for them, and earlier versions of the profile read catalina_base. It defaults to /usr/local/tomcat, the same as catalina_base, so results on the official tomcat image do not change. If you set catalina_base because Tomcat is installed elsewhere, also set catalina_home. Otherwise these controls check /usr/local/tomcat: SV-222947 then finds no files and passes, and SV-222948 and SV-222986 fail on the missing directory.
• The profile-inputs.yaml files for all three profiles changed:
  • ubuntu2204 and ubuntu2404: regenerated from the new profiles’ defaults. Each lists every input its profile declares, with its default value, so an evaluation that passes the file gets the same results as one that does not. The ubuntu2404 file drops the inputs its profile no longer declares.
  • apache-tomcat-9: adds catalina_home and removes ssl_enabled_protocols, which no control reads since SV-222927 and SV-222929 were removed.
  • A Hash input in an inputs file replaces the profile’s default completely, so use the new files rather than older copies. With the previous ubuntu2404 file, SV-270714 (CAT I) passes images that allow null passwords, SV-270725 checks RHEL’s /etc/pam.d/system-auth again, and on images that have journal files, journalctl or /var/log/syslog, SV-270757, SV-270758 and SV-270770 fail with an input error.

On the official tomcat:9.0, ubuntu:22.04 and ubuntu:24.04 images that Anchore tests with (Tomcat 9.0.109, Ubuntu 22.04.5 and 24.04.3), evaluated without an inputs file, the totals change as follows:

apache-tomcat-9 SV-222971 appears under both Fixed: Wrong Passes and Fixed: Wrong Failures: the previous version checked only the Connector’s clientAuth attribute, so it failed some configurations that require client certificates and passed some that do not.

Fixed: Wrong Passes

• ubuntu2204 SV-260570 and ubuntu2404 SV-270714 (blank or null passwords, CAT I) read RHEL’s PAM files, which Ubuntu does not have, so they passed every image. They now check /etc/pam.d/common-auth and /etc/pam.d/common-password, as the current STIG releases do; DISA added common-auth after the releases the previous profiles implemented. The official ubuntu:22.04 and ubuntu:24.04 images have nullok in common-auth, so they now fail these controls. Earlier ubuntu2404 inputs files carried the same RHEL paths.
• ubuntu2204 SV-260489 and ubuntu2404 SV-270756 checked only the mode of the /var/log directory. They now check the log files in it, as DISA’s check does: log files more permissive than 0640 fail, apart from the files DISA excludes (btmp, wtmp and lastlog, and in ubuntu2404 also history.log and eipp.log.xz). The official images have four such files (faillog, alternatives.log, dpkg.log and bootstrap.log at 0644).
• ubuntu2404 SV-270765 required /var/log to be group-owned by root. DISA requires syslog, so the official ubuntu:24.04 image, whose /var/log is group-owned by root, now fails it.
• apache-tomcat-9 SV-222971 passed a Connector with clientAuth="true" even when an SSLHostConfig on it did not require client certificates. It now checks the certificateVerification of each SSLHostConfig, as V3R5 asks, and fails any that does not require client certificates.

Fixed: Wrong Failures

• ubuntu2204 SV-260569 and ubuntu2404 SV-270725 (stored password hashes) read RHEL’s /etc/pam.d/system-auth, which Ubuntu does not have, so they failed every image, including ones configured as DISA asks. They now check the pam_unix.so line in /etc/pam.d/common-password for sha512 with at least 100000 rounds. ubuntu2404 SV-270725 also expects the [success=1 default=ignore] control and the obscure and shadow options from DISA’s example line, so a line that has sha512 and enough rounds but differs from that example still fails. The official images use yescrypt, so they still fail these controls.
• ubuntu2204 SV-260496 failed on the set-group-ID shadow binaries in the official ubuntu:22.04 image (chage, expiry, unix_chkpwd and pam_extrausers_chkpwd), which DISA’s check excludes. ubuntu2404 SV-270703 failed on the same files in ubuntu:24.04, although DISA allows shadow and the other required system groups. Both images now pass. In ubuntu2404, the allowed groups are in the new system_command_groups input.
• ubuntu2204 SV-260542 and ubuntu2404 SV-270724 required root’s password field to be !*. DISA checks that passwd -S root reports the account as locked (L), which the official images do, so they now pass.
• apache-tomcat-9 SV-222971 failed configurations that require client certificates in an SSLHostConfig (certificateVerification="required"), Connectors without an address attribute (“Unable to find address field”), and servers whose Connectors all use the address 127.0.0.1 or ::1. It now passes these. The official tomcat:9.0 image still fails it, because its Connector does not require client certificates. The control reports Not Applicable when the inputs set behind_a_loadbalancer: false or mutual_authentication_not_required: true.

Other checks also changed with the new STIG releases, so compare your results after you rescan.

Update and Rescan

• After your deployment has synced the update, run anchorectl stig write-profiles again, then rescan Tomcat 9, Ubuntu 22.04 and Ubuntu 24.04 images.
• If you pass profile-inputs.yaml with --stig-input-file, use the new file, or check your own copy against it.
• If your Tomcat inputs file sets catalina_base, also set catalina_home.
• To see which commands replace an image’s existing evaluation, see Managing STIG Evaluations.
• Images that you do not rescan keep their previous results.