Software-update: OpenHAB 3.2.0

openHAB logo (svg)OpenHAB is domoticasoftware waarmee componenten uitgelezen en aangestuurd kunnen worden. Daarbij kun je denken aan lichtschakelaars, diverse sensors, ledlampen, beveiligingsapparatuur en tal van andere domoticahardware. Het kan via zogenaamde bindings onder andere praten via Z-Wave, Nest en Zigbee, of producten van Ikea Trådfri, Xiaomi Smart Home en Philips Hue aansturen. Voor meer informatie verwijzen we naar deze pagina en voor gebruikerservaringen kun je ook op ons Forum terecht, in het Het Grote OpenHAB topic. De ontwikkelaars hebben OpenHAB 3.2 uitgebracht en de release notes voor die versie zien er als volgt uit:

openHAB 3.2 Release

Our winter release of openHAB 3.2 is out! This latest version contains many new add-ons, enhanced voice features, automation improvements and more! Another year is coming to its end and so it is time for us to bring you this openHAB release just in time for the festive season!

In the recent days and weeks the IT industry has been dealing with the fallout from vulnerabilities found in the log4j library, aka Log4Shell - prompting around the clock remediation efforts by developers and other IT professionals, especially those who operate Java based systems.

As openHAB is based on Java, we were impacted as well. To ensure we are protecting our users and community, we have addressed the major risks through the 3.0.4 and 3.1.1 patch releases that were published shortly after the fixed log4j 2.15 was out. Looking at the statistics of Maven Central that are provided by Sonatype, we have been ahead of many in the general industry, while at least 50% are still consuming vulnerable log4j versions < 2.15.

Since log4j 2.15 has been released, many security researchers have focused on testing this new version, and in consequence further (partially less critical) issues were found that led to the latest log4j versions 2.16 and 2.17 being released. We are happy to tell you that openHAB 3.2 already contains the (as of writing) very latest version 2.17, which should give our users a good reason to update their installations.

This dramatic log4j story has shed light on a larger issue we have in our industry: Open Source maintenance is often only done by engaged individuals in their spare time and their work is rarely recognized by the people that depend on such libraries. In the case of log4j, two passionate developers are taking care of the project in their free time, while nearly the entire Java industry depends on it. These people do a tremendous job and they hopefully get the recognition (and sponsors from the industry) they deserve.

Having said this, I would like to also make sure that our openHAB committers are recognized for their work. While I often do the announcements, I don't contribute to the code base that much anymore - the major work is on the shoulders of many individuals that - most of the time silently - keep coding and contributing to our common project. I therefore like to thank every contributor, especially the ones of the 18 new add-ons that are included in the 3.2 release.

OpenHAB

Versienummer 3.2.0
Releasestatus Final
Besturingssystemen Java
Website OpenHAB
Download https://github.com/openhab/openhab-distro/releases/tag/3.2.0
Licentietype GPL

Door Bart van Klaveren

Downloads en Best Buy Guide

21-12-2021 • 14:08

2

Submitter: lampy25

Bron: OpenHAB

Update-historie

09-'24 openHAB 4.2.2 12
08-'24 openHAB 4.2.1 0
07-'24 openHAB 4.2.0 1
06-'24 openHAB 4.1.3 3
03-'24 openHAB 4.1.2 0
01-'24 openHAB 4.1.1 0
12-'23 openHAB 4.1 0
11-'23 openHAB 4.0.4 0
09-'23 openHAB 4.0.3 4
08-'23 openHAB 4.0.2 20
Meer historie

Reacties (2)

2
2
2
1
0
0
Wijzig sortering
Hoewel het in het artikel (/changelog) duidelijk wordt vermeld, toch nog even herhalen: zonder deze update is je OpenHAB installatie kwetsbaar voor aanvallers van buitenaf die zomaar eventjes willekeurige code op je systeem kunnen uitvoeren (bvb ransomware, bitcoin miners, etc.).

Het volstaat niet om te zeggen dat je OpenHAB achter een NAT/firewall staat (het kan helpen en in sommige gevallen waarschijnlijk de grootste 'attack surface' wegnemen, maar vertrouw er toch maar niet op en installeer asap de update).

Er zijn de voorbije anderhalve week verschillende andere CVE's naar boven gekomen, dus het kan van belang zijn om toekomstige updates goed in de gaten te houden.
Mogelijk heeft de software een autoupdate functie?
Zeker in deze tijden verstandig om aan te zetten.

Ik wil het ooit nog een keer testen maar ik wacht nog wel even tot de roemer rond log4j voorbij is.

Op dit item kan niet meer gereageerd worden.