HTTP TRACE method activated

[SebastienSyd]

Meta -

OS:
any
Selenium Version:
any, including 3.4.0
Browser:
any

Expected Behavior -

HTTP TRACE method disabled

Actual Behavior -

HTTP TRACE method activated on Selenium Hub port

Steps to reproduce -

>curl  -X TRACE http://localhost:4444/
TRACE / HTTP/1.1
User-Agent: curl/7.33.0
Accept: */*

We use Selenium in a Production environment and the Selenium Hub doesn't pass the vulnerability audit due to HTTP TRACE method activated

Is there a way to disable that HTTP method when starting the Selenium Hub?

[LinuxSuRen]

focus

[SebastienSyd]

Any hints on how to address that issue?

Thank you