* Add an Ubuntu matrix with 18.04, 20.04, 22.04, 23.04
* Make some steps conditional based on the environment
* Add a macOS matrix with macOS-11 and macOS-12
* Use Homebrew and a local Redis service started by `brew` on the macOS
runners
ACLs were not considered when processing commands coming over WebSocket
connections. WS commands that are disabled with ACLs are now rejected
with a custom message for JSON and raw WS clients, the two supported
formats for this protocol. For JSON an equivalent HTTP status code is
included in the response, although this is only an indication of how
Webdis would have responded if it came from a regular HTTP request.
Tests are added to validate that DEBUG commands are rejected by Webdis
without even making it to Redis, for both JSON and raw WS clients.
Add DEBUG OBJECT demo to websocket.html: DEBUG is disabled with ACLs
by default in webdis.json. A DEBUG button is added to the WebSocket
HTML demo to show what kind of response is produced when WebSocket
clients attempt to send such a command.
The error responses are documented in the README in the ACL section.
Fixes#240.
* Use v2 versions of the CodeQL actions
* Update runner to Ubuntu 20.04, specify container with the same OS
* Update flags to apt-get install, was using a deprecated option
New feature: added support for TCP keep-alive on connections to Redis.
Bugfix: TRACE logs were not correctly identified as such in the logs,
they should now appear with a T prefix.
Security: this is also a security update, fixing vulnerabilities found
in the OpenSSL library, installed from Alpine Linux packages (Alpine
Linus provides the base image for Webdis).
Impact: Webdis can connect to external Webdis instances over TLS.
By default, it does not use TLS to connect to Redis, but interfaces
with Redis over a local connection within the Docker container.
Please review whether these OpenSSL vulnerabilities affect your
deployment. If you do not use TLS to connect to Redis, then you should
not be affected.
openssl 3.0.8-r1 - 1 HIGH, 6 MEDIUM
pkg:apk/alpine/openssl@3.0.8-r1?os_name=alpine&os_version=3.17
* HIGH CVE-2023-2650
https://scout.docker.com/v/CVE-2023-2650
Affected range : <3.0.9-r0
Fixed version : 3.0.9-r0
* MEDIUM CVE-2023-1255
https://scout.docker.com/v/CVE-2023-1255
Affected range : <3.0.8-r4
Fixed version : 3.0.8-r4
* MEDIUM CVE-2023-3817
https://scout.docker.com/v/CVE-2023-3817
Affected range : <3.0.10-r0
Fixed version : 3.0.10-r0
* MEDIUM CVE-2023-3446
https://scout.docker.com/v/CVE-2023-3446
Affected range : <3.0.9-r3
Fixed version : 3.0.9-r3
* MEDIUM CVE-2023-2975
https://scout.docker.com/v/CVE-2023-2975
Affected range : <3.0.9-r2
Fixed version : 3.0.9-r2
* MEDIUM CVE-2023-0466
https://scout.docker.com/v/CVE-2023-0466
Affected range : <3.0.8-r3
Fixed version : 3.0.8-r3
* MEDIUM CVE-2023-0465
https://scout.docker.com/v/CVE-2023-0465
Affected range : <3.0.8-r2
Fixed version : 3.0.8-r2
openssl1.1-compat 1.1.1t-r1 -- 2 MEDIUM
pkg:apk/alpine/openssl1.1-compat@1.1.1t-r1?os_name=alpine&os_version=3.17
* MEDIUM CVE-2023-3446
https://scout.docker.com/v/CVE-2023-3446
Affected range : <1.1.1u-r1
Fixed version : 1.1.1u-r1
* MEDIUM CVE-2023-0465
https://scout.docker.com/v/CVE-2023-0465
Affected range : <1.1.1t-r2
Fixed version : 1.1.1t-r2
This addresses multiple vulnerabilities found in OpenSSL, which is
bundled in the Docker image to allow Webdis to connect to Redis over a
secure TLS connection. Full list of CVEs to be published in the
upcoming release notes for Webdis 0.1.22.
Security update, fixing vulnerabilities found in the Alpine Linux base
image as well as the embedded Redis service and SSL libraries.
Additionally and not related to security: fixed build issues with
CentOS 7
= Security fixes =
Urgency: HIGH
Note for the list of vulnerabilities provided below:
The "Impact" described only applies if the Webdis image is used
without changes. If Webdis is used as a base image, please review
whether the changes made to it can cause these vulnerabilities to
become exploitable.
== Critical severity ==
Description: Out-of-bounds Write in zlib (CVE-2022-37434)
Info: https://security.snyk.io/vuln/SNYK-ALPINE314-ZLIB-2976174
Origin: zlib/zlib@1.2.11-r3, from the base image
Impact: Webdis uses zlib to support HTTP compression
== High severity ==
Description: Loop with Unreachable Exit Condition ('Infinite Loop')
Info: https://security.snyk.io/vuln/SNYK-ALPINE314-OPENSSL-2426333
Origin: openssl/libcrypto1.1
Impact: Webdis only uses TLS to connect to Redis
Description: Execute arbitrary code via netstat (CVE-2022-28391)
Info: https://security.snyk.io/vuln/SNYK-ALPINE314-BUSYBOX-2440608
Origin: introduced by the base image, alpine:3.14.3
Impact: netstat is not used by Webdis
Description: Arbitrary Code Injection in Redis (CVE-2022-24735)
Info: https://security.snyk.io/vuln/SNYK-ALPINE314-REDIS-2805760
Origin: introduced by the embedded Redis service, version 6.2.6
Impact: Webdis embeds this vulnerable version of Redis
Description: NULL Pointer Dereference in LibSSL3
Info: https://snyk.io/vuln/SNYK-ALPINE317-OPENSSL-3314660
Origin: introduced by libssl3, a dependency of Redis
Impact: Webdis connects to its internal Webdis instance over TLS
Description: Double Free in LibSSL3
Info: https://snyk.io/vuln/SNYK-ALPINE317-OPENSSL-3314657
Origin: introduced by libssl3, a dependency of Redis
Impact: Webdis connects to its internal Webdis instance over TLS
Description: Access of Resource Using Incompatible Type in LibSSL3
Info: https://snyk.io/vuln/SNYK-ALPINE317-OPENSSL-3314651
Origin: introduced by libssl3, a dependency of Redis
Impact: Webdis connects to its internal Webdis instance over TLS
Description: Use After Free in LibSSL3
Info: https://snyk.io/vuln/SNYK-ALPINE317-OPENSSL-3314650
Origin: introduced by libssl3, a dependency of Redis
Impact: Webdis connects to its internal Webdis instance over TLS
Description: NULL Pointer Dereference in LibSSL3
Info: https://snyk.io/vuln/SNYK-ALPINE317-OPENSSL-3314647
Origin: introduced by libssl3, a dependency of Redis
Impact: Webdis connects to its internal Webdis instance over TLS
== Medium severity ==
Description: NULL Pointer Dereference in Redis (CVE-2022-24736)
Info: https://security.snyk.io/vuln/SNYK-ALPINE314-REDIS-2805761
Origin: introduced by the embedded Redis service, version 6.2.6
Impact: Webdis embeds this vulnerable version of Redis
Description: Inadequate Encryption Strength in openssl (CVE-2022-2097)
Info: https://security.snyk.io/vuln/SNYK-ALPINE314-OPENSSL-2941807
Origin: openssl/openssl@1.1.1l-r0, openssl/libssl1.1@1.1.1l-r0
Impact: Webdis only uses TLS to connect to Redis
== Low severity ==
Description: Integer Overflow or Wraparound in Redis (CVE-2022-35977)
Info: https://security.snyk.io/vuln/SNYK-ALPINE314-REDIS-3243491
Origin: introduced by the embedded Redis service, version 6.2.6
Impact: Webdis embeds this vulnerable version of Redis
Description: Integer Overflow or Wraparound in Redis (CVE-2023-22458)
Info: https://security.snyk.io/vuln/SNYK-ALPINE314-REDIS-3243489
Origin: introduced by the embedded Redis service, version 6.2.6
Impact: Webdis embeds this vulnerable version of Redis
Webdis needed a number of small fixes to build and run on CentOS 7
(released in 2014). Initially reported in PR #231 as a missing -std=
compiler flag, there turned out to be more tweaks needed to cleanly
build and run.
Several string functions were used without an explicit include.
This was discovered using an old version of GCC which warned about them;
these warnings are not seen with more recent compilers.
This was unnecessarily limiting, since users could legitimately want to
use a symlink for the config file. It is also unsupported on some
platforms; this was discovered when attempting to build Webdis on CentOS 7.
- Smaller Docker image size
- Bugfix: avoid responding to the wrong client (this could happen in rare cases)
- Better handling of WebSocket frames (details in #212)
- Fix regression introduced in 0.1.19, causing an empty header to be sent (#217)
Fix for #217, a regression added in #205. The "header_count"
field was incremented even when we overwrote a header entry, which
caused Webdis to send a header with no name and no value.
Better handling of WS client frames, contributed in the comments of #212:
* Reject unmasked frames as per RFC 6455
* Avoid unnecessary data copy from/to evbuffer
* Remove conditions on has_mask
2 new tests cover this change:
* minimal ping-pong with masked client frame, unmasked response
* rejected unmasked client frame
Nicolas Favre-Felix
Jessie Murray
quocbao