Note: please note that Liferay has renamed its Liferay Experience
Could offerings to Liferay SaaS (formerly LXC) and
Liferay PaaS (formerly LXC-SM).
Issue
- If you are using HTTP/2, nginx and below tomcat versions, you could suffer from HTTP/2 rapid reset attack (CVE-2023-44487)
- from 8.5.0 to 8.5.93;
- from 9.0.0-M1 to 9.0.80;
- from 10.1.0-M1 to 10.1.13.
Environment
- Liferay PaaS with Liferay DXP 7.2.
Resolution
- Tomcat version that comes with last 7.2 image is still vulnerable, it will be updated as soon as possible and new images will be published. Tomcat versions not affected by this issue: 8.5.94, 9.0.81 and 10.1.14
- In order to mitigate the attack, you can configure below variables in your webserver service (nginx):
- keepalive_requests set default value (1000 requests)
- http2_max_concurrent_streams set default value (128 streams)
- You can also adjust below variables in order to mitigate the issue, the values of this variables should be adjusted taking
- limit_conn number of connections from a single client. It should be adjusted taking into account the balance between security and performance
- limit_req number of processed requests that will be attended from a single client. It should be adjusted taking into account the balance between security and performance
Additional Information