Skip to content

The Unforgiven
Compare
Choose a tag to compare
@knight-of-ni knight-of-ni released this 30 Mar 22:45
· 18587 commits to master since this release
1.30.2
a66c15f

Slight Change of Plans

Vulnerabilities! Yikes!
We had several reports of vulnerabilities come in during the last release candidate. We thank the security professionals for taking the time to review our project and have been hard at work implementing fixes. There are a few remaining vulnerabilities, similar to ones we already fixed, which we cannot currently duplicate. The purpose of this release is to establish a new baseline for testing before the next 1.30.3 release. If any of the remaining vulnerabilities turn out to be valid, understand that they require valid ZoneMinder user credentials to implement.

Because some of the vulnerabilities go back as far as our github history tracks, we recommend everyone upgrade to this version of ZoneMinder.

Yes, this also means the next 1.30.3 release will also be a bug fix release. It will not be a new feature release as we had hoped.

Thank You to Those who have Contributed

First, a big thank you to those who have contributed their time to this project, or who have contributed financially. The money donated to the project is primarily used to maintain an Internet presence. The donated funds are not used as income for our developers. We do occasionally assign funds to open issues through Bountysource, but those funds can be claimed by anyone who does the work. We all, from those that respond to questions in the forums to those who develop the underlying code, are effectively volunteers, each with our own $dayjobs. We participate because we want to be part of an open-source, community project, which brings me to my next point.

We know from our telemetry data that ZoneMinder has an extremely large user base. In just one week, we received 20k ip addresses, actively running ZoneMinder, and those sites are just the sites who have the telemetry data enabled. On the flip side to this, there are comparatively few people who contribute back to the project. This puts us in a perpetual situation where we cannot keep up whether that be responding in the forums, writing new code, fixing existing code, writing documentation, etc. We are looking for help from mature individuals who understand what it means to be part of a team project. To become part of the team, you don't need to know how to do a particular task, write code, etc. Rather, you simply need a strong desire to learn and interact with the other members.

Bug Fix Release

While there are a few new features, this release focuses on bug fixes and improvements to existing code.

Here is the short list of changes:

  • Various sql injection, xss, and other vulnerabilities have been fixed.
  • CVE-2017-5368, CVE-2016-10206 Added CSRF mitigation. This option ENABLE_CSRF_MAGIC defaults to OFF currently and must be turned on under Options. Packagers should choose to default on to resolve CVE-2017-5368 and CVE-2016-10206. If a package maintainer wants to change the default, then they should do the following in the build script before calling cmake: ./utils/zmeditconfigdata.sh ZM_ENABLE_CSRF_MAGIC yes
  • Fixed an issue where the red outline did not appear in images with blob detection enabled
  • The new ONVIF probe should now properly detect many more ONVIF compliant cameras
  • A few security fixes were implemented to help mitigate malicious activity
  • Various updates to the documentation including an emphasis to use the "ffmpeg" source type for modern IP cameras. Only use the other source types if there is a problem using ffmpeg.
  • New Hikvision & Keekon PTZ control scripts have been added
  • Since the amount of free /dev/shm memory is critical, this is now shown at the top of the web console.

A Notice about the next release following 1.30.3

We have had a number of big ticket items in the works for a while now, and after a recent discussion, we have decided to implement some, or perhaps all, of these major features following the release of 1.30.3. I won't name there here, because the list of features we deploy might change. What I do want to emphasize, however, is that the release which contains these new features will need to run its course to find and work out any bugs which will likely be introduced. So if you are running a production system and don't want reliability to suffer, then I would recommend you upgrade to 1.30.3, but skip the next release after that.

As always, here is the long list of changes:

Change Log

1.30.2 (2017-03-30)

Full Changelog

Merged pull requests:

1.30.2-rc.1 (2017-02-05)

Full Changelog

Merged pull requests:

* This Change Log was automatically generated by github_changelog_generator

Assets 2
Loading