Tools

Mitigation for HTTP/2 Rapid Reset Vulnerability for Tomcat CVE-2023-44487 in Web Help Desk

WHD 12.7.2 through 12.8 ships with a version of Tomcat affected by CVE-2023-44487. Upgrade the version of Tomcat that WHD uses to mitigate the vulnerability.

First published date

10/20/2023 6:39 PM

Last published date

1/30/2025 12:21 AM

Overview

In October of 2023, the National Institute of Standards and Technology (NIST) published the following security bulletin about a potential denial of service (DOS) vulnerability, known as Rapid Reset, in HTTP/2 protocol:

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly.

In Tomcat 8.5.0 through 8.5.93 and 9.0.0 through 9.0.80, the HTTP/2 implementation is affected by this vulnerability. Web Help Desk (WHD) 12.7.2 through 12.8 ships with an affected version of Tomcat.

Product section

Web Help Desk

Cause

CVE-2023-44487

Resolution

Resolution 1: Upgrade WHD

In WHD 12.8.1, Tomcat 9.0.82 is included and resolves this issue without the manual steps below. Consider upgrading your environment to address this issue if possible.

Resolution 2: Update the version of Tomcat that WHD uses

If an upgrade is not possible, you can mitigate this issue by updating the version of Tomcat that WHD uses.

  1. Make a backup copy of the following folder:

    ...\webhelpdesk\bin\tomcat

  2. Download Tomcat 9.0.82.

  3. Extract the contents of the downloaded file, and rename the folder to tomcat.

  4. Copy the server.xml file from your original ...\webhelpdesk\bin\tomcat\conf\ folder and paste it into the new tomcat\conf folder.

  5. Copy the following files from your existing ...\webhelpdesk\bin\tomcat\lib folder and paste them into the new tomcat\lib folder:

    • logger.jar
    • tomcat-sorting-cl-1.0.0.jar

  6. Stop the WHD server.

  7. Remove the original tomcat folder, and replace it with the new tomcat folder.