[Bug]: 29.0.11 RC1 & 30.0.5 RC1: Security & setup warnings: Failed to write and read a value from distributed cache

[RainerEmrich]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Got this message after upgrade from 29.0.10 to 29.0.11 RC1. Nothing else changed.
Distributed cache is Redis. I think that's a false positive, no entries in the logs.
Any comments?

Steps to reproduce

1. Upgrade nextcloud which uses redis as ditributed cache from 29.0.10 to 29.0.11 RC1.

Expected behavior

There should be no error in the Security & setup warnings.

Nextcloud Server version

29

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "testcloud.emrich-ebersheim.de"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/testcloud.emrich-ebersheim.de\/",
        "htaccess.RewriteBase": "\/",
        "dbtype": "mysql",
        "version": "29.0.11.0",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "UTC",
        "installed": true,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0,
            "dbindex": 0,
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "filelocking.enabled": true,
        "appstore.experimental.enabled": "true",
        "updater.release.channel": "stable",
        "mail_smtpmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "enable_previews": true,
        "preview_max_x": 1024,
        "preview_max_y": 1024,
        "preview_max_scale_factor": 8,
        "trashbin_retention_obligation": "auto",
        "maintenance": false,
        "default_language": "de",
        "default_phone_region": "DE",
        "theme": "",
        "loglevel": 2,
        "mysql.utf8mb4": true,
        "app_install_overwrite": [
            "files_readmemd",
            "co2clock",
            "data_request",
            "carnet",
            "breezedark"
        ],
        "has_rebuilt_cache": true,
        "mail_sendmailmode": "smtp",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "maintenance_window_start": 2
    }
}

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

[RainerEmrich]

For nextcloud 30.0.5 RC1 it's the same.

[joshtrichards]

Confirmed.

It's an interaction between random_bytes() and this bit of code:

server/lib/private/Memcache/Redis.php

Lines 214 to 220 in a850a0b

	protected static function encodeValue(mixed $value): string {
	return is_int($value) ? (string)$value : json_encode($value);
	}
	protected static function decodeValue(string $value): mixed {
	return is_numeric($value) ? (int)$value : json_decode($value, true);
	}

The easiest solution is to bin2hex() $random before we set it I think.