LoginSign Up
← Back to all sparks
Z

ZoneMinder

INFRA · APIS
Velocity5.0

Video surveillance and CCTV management system

zoneminder.com ↗

ZoneMinder 1.38.5 fixes 19 vulnerabilities, including authenticated remote code execution

video-surveillancesecurity-hardeningrbacapi-authorizationself-hosted
◆Current state
ZoneMinder's 1.38 line is in security maintenance. 1.38.5 fixes 19 reported vulnerabilities, including authenticated OS command execution through the filter debug modal, a JPEG heap overflow and cross-monitor authorization bypasses. It replaces a default or empty auth hash secret on upgrade and refuses token logins while the public default is set. 1.38.6 followed within the hour only to fix RPM builds, since no 1.38.5 RPMs were published.
◆Where it's heading
Every 1.38 release since June has been mostly authorization and memory-safety work. The 1.38.0 feature set (RBAC, WebRTC, the monitor function split) is being made safe rather than extended.
◆Prediction
Further security releases on 1.38 are likely; the entries give no sign of a 1.39 feature release.

◆Recent moves

  1. 1mo ago

    ZoneMinder 1.38.6 republishes 1.38.5 with fixed RPM builds

    A packaging release that links stdc++fs for GCC 8, so RPMs for 1.38.5's security fixes can finally be published. Code is otherwise identical to 1.38.5.

    View source ↗
  2. 1mo ago

    ZoneMinder 1.38.5 fixes 19 vulnerabilities, including RCE

    Fixes 19 vulnerabilities, including authenticated command execution and a heap overflow, and refuses JWT logins while the auth secret is the shipped default. The largest of the 1.38 security releases.

    View source ↗
  3. 2mo ago

    1.38.4 closes API ACL gaps and two auth bypasses

    Per-monitor access control is now enforced on the EventData, Tags, and Frames controllers and on direct event, frame, zone, and media endpoints, with two token-validation auth bypasses fixed alongside it. Filed as a maintenance release, but it is the largest authorization sweep since RBAC arrived in 1.38.0.

    View source ↗
  4. 4mo ago

    1.38.3 supersedes 1.38.2 with RBAC and injection fixes

    The same pattern one release earlier: RBAC checks added to ConfigsController, command injection closed in the monitor device path, and URLs escaped in camera presets. It also replaces 1.38.2, which was tagged but never shipped after Debian packaging hit a cross-distro tarball conflict.

    View source ↗
  5. 5mo ago

    chore: bump redhat spec version to 1.39.11

    A packaging chore syncing the RedHat spec file to version.txt after a security release. No functional change.

    View source ↗
  6. 8mo ago

    1.36.38 backports a SQL injection fix to the legacy branch

    The legacy 1.36 branch gets its own SQL injection fix in stored event name and cause fields, plus rotation-aware default zone creation and timezone handling fixes. Keeping security backports flowing to a branch two minor versions behind says a lot about how slowly self-hosted CCTV installs upgrade.

    View source ↗