Nemesida WAF Release Notes 2024 | Nemesida WAF

Updated versions of Python pip dependencies due to the release of security fixes.

Fixed errors in the functionality of managing the list of blocked IP addresses.

Dynamic module:

• Cumulative package of updates and improvements.

Nemesida AI MLA:

• Improved the mechanism of monitoring the use of hardware resources.

• Improved the mechanism for analyzing the activity of parasitic bots;
• Other fixes and improvements.

When certain types of events are detected, Nemesida AI MLC transmits the IP address of the event source and its type (for example, DDoS/Brute-force, etc.) to the service API (nemesida-security.com) to improve threat analysis.

Dynamic module:

• Correcting the request processing with Content-type: multipart/form-data header;
• Extended logging of interaction with the ClamAV and ICAP interfaces;
• Extended the list of header Content-type values for the option nwaf_body_bin_exclude (deactivation of the analysis of the binary content of the BODY zone by the signature method, as well as sending the contents of the zone to the Nemesida AI MLA and Nemesida AI MLC modules);
• Other fixes and improvements.

Other fixes and improvements.

• Fixes related with attack statistics output;
• Added functionality to manage the result of the machine learning module and fine-tuning behavioral models through API calls;
• Added automatic rotation of component log files.

Dynamic module:

• Extended the list of header Content-type values for the option nwaf_body_bin_exclude (deactivation of the analysis of the binary content of the BODY zone by the signature method, as well as sending the contents of the zone to the Nemesida AI MLA and Nemesida AI MLC modules).

Nemesida AI MLA:

• Minor changes related to the processing of the request data.

Minor changes related to the processing of the request data.

Extended the receiving information about attacks functionality.

Other fixes and improvements.

Dynamic module:

• Added support for Nginx Mainline 1.27.2;
• Fixed the processing of duplicate virtual host values in the option nwaf_host_lm (activation of the monitoring mode for analyzing requests for a virtual host), received from the Nemesida WAF API.

Dynamic module:

• Fixed the processing of duplicate virtual host values in the option nwaf_host_lm (activation of the monitoring mode for analyzing requests for a virtual host), received from the Nemesida WAF API.

Dynamic module:

• Fixes related to RabbitMQ settings for receiving big data.

Nemesida AI MLA:

• Minor corrections related to the normalization of request data.

• Fixes related to RabbitMQ settings for receiving big data;
• Minor corrections related to the normalization of request data.

Dynamic module:

• Fixed the operation of the option nwaf_limit (the condition for automatically blocking an IP address).

Fixed validation of the filtering node settings.

Dynamic module:

• Fixed working with single IPv6 addresses when creating a list of blocked IP addresses;
• Other fixes and improvements.

Nemesida AI MLA:

• Improved the request decoding mechanism.

• Improved the request decoding mechanism.

• Fixes related to the processing of the Other_headers field in the extended request blocking rules;
• Other fixes and improvements.

Dynamic module:

• Improved the RAM usage controlling mechanism.

Extended the functionality of validating the parameters of the filter node settings.

Dynamic module:

• Added support for Nginx 1.26.2 Stable and Nginx 1.27.1 Mainline.

• Optimizing the use of server resources when loading a summary page;
• Fixes related to obtaining GeoIP data about IP address;
• Other fixes and improvements.

Minor fixes and improvements.

Fixes related to setting conditions for automatic request blocking.

• The functionality of detecting DDoS attacks has been expanded by defining attacks such as web scraping;
• Other fixes and improvements.

Dynamic module:

• Reduced server RAM usage;
• Other fixes and improvements.

Nemesida AI MLA:

• Other fixes and improvements.

• An improved mechanism for managing behavioral models has been added;
• Other fixes and improvements.

Updated versions of Python pip dependencies.

Minor fixes related to the use of a list of blocked IP addresses.

• The mechanism of interaction with the new version of Nemesida WAF API has been adapted;
• The functionality of configuring the module for detecting attacks by brute force and flood has been expanded;
• Other fixes and improvements.

For the component to work correctly, you must update the Nemesida WAF API before updating the component.

• An improved mechanism for managing the settings of Nemesida WAF has been added;
• Fixed normalization of national domains used when configuring Nemesida WAF components;
• Other fixes and improvements.

• Added the ability to exclude IP addresses from Bruteforce/Flood analysis;
• Fixed an error that occurs when adding a duplicate user;
• Added support for request blocking conditions based on the presence of an address in Tor/Proxy/VPN lists in the extended request blocking rules (ERL);
• Other fixes and improvements.

Dynamic module:

• Added support for Nginx 1.26.1 Stable, Nginx 1.27.0 Mainline and Nginx Plus R32.

Nemesida AI MLA:

• Minor fixes.

Dynamic module:

• Added support for Nginx 1.25.5 Mainline;
• Added support for request blocking conditions based on the presence of an address in Tor/Proxy/VPN lists in the extended request blocking rules (ERL);
• Reduced the count of false positives when decoding data in Base64;
• Other fixes and improvements.

Nemesida AI MLA:

• Added support for downloading Tor/Proxy/VPN lists from the GeoIP server;
• Fixes related to data decoding in Base64;
• Other minor fixes.

• Added support for brute__wl_ip options for Nemesida AI MLC;
• Added support for the block_tor and block_proxy options for extended request blocking rules (ERL);
• Fixes related to wildcard domain validation;
• Fixes related to the processing of the http2 parameter when managing Nginx settings via the Nemesida WAF API.

• Added the ability to exclude IP addresses from Bruteforce/Flood analysis;
• Improvements related to request processing in detecting DDoS L7 and Bruteforce attacks;
• Minor fixes related to file upload and processing;
• Fixes related to the transmission of anomalies detected by the machine learning module to the Nemesida WAF API;
• Fixes related to data decoding in Base64;
• Other minor fixes.

Minor fixes related to the processing of the PID file.

Fixes related to obtaining specifications created by Nemesida AI MLC when accessing
/nw-api/get_openapi_schema_paths.

Fixes related to the logging and configuration file processing system.

Added a check that forbids the simultaneous use of the readOnly and writeOnly parameters with the value true in the OpenAPI specification.

Dynamic module:

• Added compatibility with the satisfy any web-server option.

Minor fixes related to running the module in recheck mode.

Dynamic module:

• Minor fixes and improvements.

Nemesida AI MLA:

• Fixes related to the Nemesida API Firewall;
• Other minor improvements.

• Minor fixes related to DBMS interaction;
• Fixes related to the display of an extended description of the reason for blocking the request by the Nemesida API Firewall module with an empty value.

• Improved the mechanism of interaction with RabbitMQ;
• Improved the mechanism of processing GeoCC data.

Minor fixes related to the database structure and changes in the pandas library.

Dynamic module:

• Removed support for the mechanism for unlocking an IP address using a captcha (Captcha v1);
• The mechanism for unlocking an IP address using a captcha (Captcha v2) is outdated and is not recommended for further use;
• Added support for a new mechanism for unlocking IP addresses using captcha (Captcha v3);
• Added support for the ICAP protocol for interacting with antivirus solutions;
• Other fixes and improvements.

Fixes related to the use of python libraries and interaction with the database.

• Fixes related to database interaction;
• Other minor improvements.

Nemesida AI MLA:

• Fixes related to functionality changes in the python library netaddr;
• Fixes related to the operation of the API Firewall;
• Added blocking of requests during analysis by the API Firewall module if the request body is sent in JSON format with duplicate keys..

• Fixes related to sending requests with detected anomalies in the Nemesida WAF API;
• Fixes related to functionality changes in the python library netaddr;
• Other fixes and improvements.

• Fixed incorrect display of parameter values in the Nemesida WAF settings section;
• Added support for an extended description of the reason for blocking the request by the Nemesida API Firewall module;
• Added the ability to delete all entries in the behavioral model settings section;
• Other fixes and improvements.

• Minor fixes related to the functionality of configuring behavioral models;
• Fixes related to functionality changes in the python library netaddr.

Dynamic module:

• Added support for Nginx 1.25.4 Mainline and Nginx Plus R31.

Minor fixes related to the processing of the configuration file.