meilisearch @ v1.34.1
integrity
- size
- 20.2 MiB
- downloaded
- last checked
release notes
In Meilisearch v1.34.1, we released a security fix that affect web queries initiated by Meilisearch.
🔐 Security
- Cloud users: no action is needed. We found no evidence of exploitation on Meilisearch Cloud and the Cloud is protected at the infrastructure level.
- Open-source users: if you allow untrusted users to configure webhooks, embedders or network of machines, we recommend you update to Meilisearch v1.34.1
In Meilisearch versions v1.8 to v1.34.0, a user with an API key with write permissions to the configuration of the Meilisearch instance could set up Meilisearch to send POST or GET requests to domains and IPs local to the private network of the Meilisearch instance, effectively bypassing the firewall. The vulnerability has not yet been assigned a CVE number; it has CVE Request 1975471 for CVE ID.
Meilisearch v1.34.1 fixes the vulnerability by forbidding Meilisearch from making any requests to a host resolving to a non-global IP, in the sense of the IANA IPv4 Special-Purpose Address Registry or the IANA IPv6 Special-Purpose Address Registry. If you need this functionality in your Meilisearch instance, you can set private IP networks as allowed with the --experimental-allowed-ip-networks parameter after reviewing the security implications.
This is a breaking change, which is allowed for security reasons.
Allowing non-global IP networks
The --experimental-allowed-ip-networks CLI flag and the MEILI_EXPERIMENTAL_ALLOWED_IP_NETWORKS environment variable control the behavior of Meilisearch with regards to non-global IP networks, with the CLI flag taking precedence over the environment variable when both are specified.
- When missing, the default is to reject all web requests resolving to a non-global IP.
- When set to a comma-separated list of CIDR-formatted networks (e.g.
192.168.0.0/16,10.0.0.0), then web requests to the networks from the list will be permitted. Web requests to the non-global IPs not part of the list will still be rejected. - When set to
any, all web requests will be permitted regardless of the target IP, similar to the behavior of Meilisearch v1.34.0 and lower. Use this option when you control both the machine and the configuration of the deployed Meilisearch instance.
Acknowledgments
Thanks to Gabriel Rodrigues (aka Texugo), for reporting this vulnerability and for helping us improve the security of Meilisearch.
download
curl -fL -o v1.34.1.zip https://ratatoskr.space/pkg/meilisearch/v1.34.1.zip
printf '%s %s\n' '02c1e3deb236af99683708390eba04330a16e97d5361938fba99e2d38420fa6a' 'v1.34.1.zip' | sha256sum -c -
$url = "https://ratatoskr.space/pkg/meilisearch/v1.34.1.zip"
$out = "v1.34.1.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "02c1e3deb236af99683708390eba04330a16e97d5361938fba99e2d38420fa6a") { throw "sha256 mismatch" }
curl -fL -o v1.34.1.tar.gz https://ratatoskr.space/pkg/meilisearch/v1.34.1.tar.gz
printf '%s %s\n' 'f0bbd57d8d0f354c5b3e14c9611bd6a82d9ad74369c8420259ca95083c39c140' 'v1.34.1.tar.gz' | sha256sum -c -
$url = "https://ratatoskr.space/pkg/meilisearch/v1.34.1.tar.gz"
$out = "v1.34.1.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "f0bbd57d8d0f354c5b3e14c9611bd6a82d9ad74369c8420259ca95083c39c140") { throw "sha256 mismatch" }
download via yggdrasil mesh
curl -fL -o v1.34.1.zip http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/meilisearch/v1.34.1.zip
printf '%s %s\n' '02c1e3deb236af99683708390eba04330a16e97d5361938fba99e2d38420fa6a' 'v1.34.1.zip' | sha256sum -c -
$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/meilisearch/v1.34.1.zip"
$out = "v1.34.1.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "02c1e3deb236af99683708390eba04330a16e97d5361938fba99e2d38420fa6a") { throw "sha256 mismatch" }
curl -fL -o v1.34.1.tar.gz http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/meilisearch/v1.34.1.tar.gz
printf '%s %s\n' 'f0bbd57d8d0f354c5b3e14c9611bd6a82d9ad74369c8420259ca95083c39c140' 'v1.34.1.tar.gz' | sha256sum -c -
$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/meilisearch/v1.34.1.tar.gz"
$out = "v1.34.1.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "f0bbd57d8d0f354c5b3e14c9611bd6a82d9ad74369c8420259ca95083c39c140") { throw "sha256 mismatch" }
| artifact | format | size | hashes |
|---|---|---|---|
| v1.34.1.zip | zip | 20.2 MiB |
blake3-24 d699511dd6fc2b0d22fc0453db29c977ec8f9e426b0f9394
sha256 02c1e3deb236af99683708390eba04330a16e97d5361938fba99e2d38420fa6a
sha1 907586a54585699148419d67e6e775856e56de91
|
| v1.34.1.tar.gz | tar.gz | 19.2 MiB |
blake3-24 9c3bd79394c8807610d84f365b859570d27eac096b297b5c
sha256 f0bbd57d8d0f354c5b3e14c9611bd6a82d9ad74369c8420259ca95083c39c140
sha1 05e1768316e814444c5fd39dfd93b003d1d78ed5
|
install
http_archive(
name = "meilisearch",
urls = ["https://ratatoskr.space/pkg/meilisearch/v1.34.1.tar.gz"],
integrity = "sha256-8LvVfY0PNUxbPhTJYRvWqC2a10NpyEICWcqVCDw5wUA=",
strip_prefix = "meilisearch-v1.34.1",
)
.url = "https://ratatoskr.space/pkg/meilisearch/v1.34.1.tar.gz",
install via yggdrasil mesh
http_archive(
name = "meilisearch",
urls = ["http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/meilisearch/v1.34.1.tar.gz"],
integrity = "sha256-8LvVfY0PNUxbPhTJYRvWqC2a10NpyEICWcqVCDw5wUA=",
strip_prefix = "meilisearch-v1.34.1",
)
.url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/meilisearch/v1.34.1.tar.gz",