Backport http2 rapid reset cve patch about kong

[AnniePrasannaX]

Could someone please suggest how we can fix the http2 rapid-reset cve in Kong 2.0.4 ?
or how we can apply that patch from kong 3.4.2 to 2.0.4 version?

[chobits]

The version 2.0.4 is too old to be supported, but i can help provide some hints. If you only use some kong 2.0 package or image, it could be patched with http2-cve patch to this package/image. Because we need to patch the patch file to openresty source core and build it to nginx binary file.

So the important thing is that you need to find out how to build openresty/nginx binary for kong 2.0, and then check the openresty version and examine how to patch the source patch to that openresty (nginx core), and modified the kong build script to intergrate the openresty patching process.

[chobits]

The above comment I left is a general approach to modify the patch progress and note that I dont have some real experience on how to build kong version 2.0.

[github-actions]

This issue is marked as stale because it has been open for 14 days with no activity.

[github-actions]

Dear contributor,

We are automatically closing this issue because it has not seen any activity for three weeks.
We're sorry that your issue could not be resolved. If any new information comes up that could
help resolving it, please feel free to reopen it.

Your contribution is greatly appreciated!

Please have a look
our pledge to the community
for more information.

Sincerely,
Your Kong Gateway team