Outdated Jansson

[Garnik645]

The project includes sources from the Jansson project, located in the webdis/src/jansson/ directory. However, those sources are old and contain unpatched vulnerabilities like CVE-2016-4425 and CVE-2013-6401. If Jansson sources are used somewhere, I recommend updating them to the latest version. My report was primarily based on a static analysis tool developed at CAST, which flagged the potential vulnerability due to similarities in the codebase.

[nicolasff]

Thanks @Garnik645! There is actually a branch of Webdis with Jansson version 2.14, following the initial commits made in #239: https://github.com/nicolasff/webdis/tree/jansson-2.14.

From these two links, it does not seem like they would apply to this newer version of the library: the first says "Jansson 2.7 and earlier", and the second "Jansson, possibly 2.4 and earlier".

I'll make sure to finish validating these contributions so they can get merged.

[nicolasff]

The jansson-2.14 branch looks good, so it will get merged very soon but I'll also try to tag a new version with these changes over the next few days.