Mitigation for HTTP/2 Rapid Reset Vulnerability for Tomcat CVE-2023-44487 in Database Performance Analyzer

In October of 2023, the National Institute of Standards and Technology (NIST) published the following security bulletin about a potential denial of service (DOS) vulnerability, known as Rapid Reset, in HTTP/2 protocol:

• CVE-2023-44487 (© 2023 National Institute of Standards and Technology, available at nvd.nist.gov, obtained on October 19, 2023)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly.

In Tomcat 8.5.0 through 8.5.93 and 9.0.0 through 9.0.80, the HTTP/2 implementation is affected by this vulnerability. Database Performance Analyzer (DPA) 12.1 through 2023.2.x ships with an affected version of Tomcat.

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

CVE-2023-44487

To mitigate this issue, update the version of Tomcat that DPA uses.

Upgrade Tomcat on Linux

If your DPA server runs a Linux operating system, complete the following steps to upgrade the version of Tomcat that DPA uses.

1. Find the current version of Tomcat:

   DPA_install_dir="<path_to_DPA_installation>"   
   # e.g. DPA_install_dir="/home/dpa/dpa_2021_1_775"
   
   cd $DPA_install_dir/iwc/tomcat/lib
   <java_home_dir>/bin/java -cp catalina.jar org.apache.catalina.util.ServerInfo 
   # example: /home/dpa/dpa_2021_1_775/iwc/jre_linux/bin/java -cp catalina.jar org.apache.catalina.util.ServerInfo			

2. Download Tomcat 9.0.82.

3. Stop DPA:

   $DPA_install_dir/shutdown.sh

4. Run the following to replace DPA's embedded Tomcat files in the lib and bin folders inside the DPA installation directory:

   tomcat_tar_gz="<path_to_downloaded_apache-tomcat-x.y.z.tar.gz>"   
   # i.e. tomcat_tar_gz="/home/dpa/apache-tomcat-8.5.61.tar.gz"
   
   cd $DPA_install_dir/iwc/tomcat
   
   # back up old 'lib' folder
   mv lib lib_backup
   
   # unpack LIB folder from the archive
   tar -x -z --wildcards --strip-components=1 -f "$tomcat_tar_gz" -- "*/lib"
   
   # preserve files related to DPA server
   cp -p lib_backup/dpa_configuration.jar lib
   cp -p -r lib_backup/org lib													
   
   # back up old 'bin' folder
   cp -p -r bin bin_backup
   BINfiles="*/bin/bootstrap.jar"
   BINfiles+=" */bin/commons-daemon.jar"
   BINfiles+=" */bin/configtest.sh"
   BINfiles+=" */bin/digest.sh "
   BINfiles+=" */bin/tomcat-juli.jar"
   BINfiles+=" */bin/tool-wrapper.sh"
   BINfiles+=" */bin/version.sh"
   tar -x -z --wildcards --strip-components=1 -f "$tomcat_tar_gz" $BINfiles # unpack files from BIN folder from the archive

5. Determine if there are two versions of an "ecj" jar file in the tomcat lib folder. This happens if the one from the newer Tomcat has a different file name to reflect the new version number. If so, remove the older version. For example:

   delete file <DPA_FOLDER>/iwc/tomcat/lib/ecj-4.5.jar - this has been replaced by newer 4.6.3 version

6. Restart DPA:

   $DPA_install_dir/startup.sh

7. Repeat step 1 to verify that Tomcat was updated.

Upgrade Tomcat on Windows

If your DPA server runs a Windows operating system, run these commands in PowerShell in administrator mode to upgrade the version of Tomcat that DPA uses.

1. Find the current version of Tomcat:

   $DPA_install_dir="<path_to_DPA_installation>"   
   #e.g. $DPA_install_dir="c:\Program Files\SolarWinds\DPA\"
   
   cd $DPA_install_dir\iwc\tomcat\lib
   & '<java_home_dir>\bin\java.exe' -cp catalina.jar org.apache.catalina.util.ServerInfo  
   # example: & 'C:\Program Files\SolarWinds\DPA\iwc\jre\bin\java.exe' -cp catalina.jar org.apache.catalina.util.ServerInfo

2. Download Tomcat 9.0.82.

3. Stop DPA:

   Stop-Service -Name IgnitePI

4. Run the following to replace DPA's embedded Tomcat files in the lib and bin folders inside the DPA installation directory:

   $tomcat_zip="<path_to_downloaded_apache-tomcat-x.y.z.zip>" 
   # i.e. $tomcat_zip="c:\Download\apache-tomcat-8.5.61-windows-x64.zip"
   
   # back up old 'lib' folder
   cd $DPA_install_dir\iwc\tomcat
   Move-Item -Path lib -Destination lib_backup
   
   # preserve files related to DPA server
   New-Item -ItemType Directory lib
   Copy-Item  -Path lib_backup\dpa_configuration.jar  -Destination lib
   Copy-Item  -Recurse -Path lib_backup\org  -Destination lib\org
   
   # back up old 'bin' folder
   Copy-Item -Recurse -Path bin -Destination bin_backup
   
   # extract files
   Add-Type -Assembly System.IO.Compression.FileSystem 
   $zip = [IO.Compression.ZipFile]::OpenRead("$tomcat_zip")
   
   # extract all files from LIB folder 
   $files = $zip.Entries | where {$_.FullName -match 'apache-tomcat-\d+\.\d+\.\d+/lib/.+'}
   $files | foreach {[IO.Compression.ZipFileExtensions]::ExtractToFile( $_, "$DPA_install_dir\iwc\tomcat\lib\" + $_.Name) }
   
   # extract these files from BIN folder
   $BINfiles = @(
   'bin/bootstrap.jar',
   'bin/commons-daemon.jar',
   'bin/configtest.bat',
   'bin/digest.bat',
   'bin/tcnative-1.dll',
   'bin/tomcat8.exe',
   'bin/tomcat-juli.jar',
   'bin/tool-wrapper.bat',
   'bin/version.bat'
   )
   
   $BINfiles = foreach ($f in $BINfiles) {$zip.Entries | where {$_.FullName -match $f}}
   $BINfiles | foreach {[IO.Compression.ZipFileExtensions]::ExtractToFile( $_, "$DPA_install_dir\iwc\tomcat\bin\" + $_.Name, $true) }
   
   $zip.Dispose()		

5. Determine if there are two versions of an "ecj" jar file in the tomcat lib folder. This happens if the one from the newer Tomcat has a different file name to reflect the new version number. If so, remove the older version. For example:

   delete file <DPA_FOLDER>/iwc/tomcat/lib/ecj-4.5.jar - this has been replaced by newer 4.6.3 version

6. Restart DPA:

   Start-Service -Name IgnitePI

7. Repeat step 1 to verify that Tomcat was updated.