mirror of
https://github.com/kerberos-io/agent.git
synced 2026-08-23 15:08:32 +00:00
b26f0190c6
Three defects in the dispatch path. Deleted was still a trigger. The Initialized guard was a denylist of one value, so a property removal with an active-looking payload passed straight through. Both Initialized and Deleted are announcements about a property, not motion starting, so accept the transitions instead: Changed, and Unknown for the events that omit the optional attribute. ev.Topic reached the log unmodified. It is camera-controlled, unbounded and unfiltered, and logrus's coloured text formatter — the default — writes the message without quoting, so an embedded newline forges whole log entries. A compromised camera could fabricate ERROR lines or spoof another device's id in the logs an operator is reading to diagnose that camera. Escape control characters and bound the length; the reject path logs every event received, so an oversized topic was also a cheap way to evict a container's retained history. The trigger line was logged before the send, so an event dropped on a full channel or at shutdown left a line claiming a recording that never started. Log it in the send case.
Kerberos Open Source - Machinery
Docker Hub | Documentation | Website
Kerberos Open source (v3) is a cutting edge video surveillance management system made available as Open Source under the MIT License. This means that all the source code is available for you or your company, and you can use, transform and distribute the source code; as long you keep a reference of the original license. Kerberos Open Source (v3) can be used for commercial usage (which was not the case for v2). Read more about the license here.
Security reporting
For sensitive vulnerabilities, use private disclosure channels documented in ../SECURITY.md.