SIPCAPTURE Homer

v11.0.283 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo Forensics & Incident Response

✓ No known CVEs patched

This release patches 3 known CVEs

Topics

analytics callflow capture-agent cdr correlation encapsulation

+14 more

flow hep kamailio monitoring opensips packet-capture packet-sniffer pcap rtc sip statistics troubleshooting voip webrtc

Affected surfaces

auth breaking_upgrade

Summary

AI summary

GHSA-f46q-3v67-fmm4, GHSA-6xp5-7rcx-xfgx, and GHSA-rqcc-94gv-wjm9 security advisories are closed.

Full changelog

This release closes three coordinator security advisories. See docs/SECURITY.md for upgrade notes.

GHSA-f46q-3v67-fmm4 — validate rawquery in POST /api/v4/statistics/query (read-only SQL only) (#837)
GHSA-6xp5-7rcx-xfgx — remove hardcoded default admin password sipcapture; random bootstrap password when hash omitted (#838)
GHSA-rqcc-94gv-wjm9 — enforce JWT on protected routes when coordinator.jwt.secret is empty; auto-persist .homer_jwt_secret (#839)

Add Security hardening guide; update auth, coordinator, wizard, and OpenAPI docs.

Docker Compose (examples/docker/) with explicit JWT_SECRET and ADMIN_PASSWORD_HASH — no credential changes.
Empty JWT secret — API now requires authentication; check coordinator logs for jwt_secret_file.
Fresh install without admin hash — bootstrap password logged once at startup.

Full Changelog: https://github.com/sipcapture/homer/compare/11.0.281...11.0.283

GHSA-f46q-3v67-fmm4 — validate `rawquery` in `POST /api/v4/statistics/query` to allow only read-only SQL
GHSA-6xp5-7rcx-xfgx — remove hardcoded admin password `sipcapture`; generate random bootstrap password when hash omitted
GHSA-rqcc-94gv-wjm9 — enforce JWT authentication on protected routes when `coordinator.jwt.secret` is empty; auto-persist `.homer_jwt_secret`

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track SIPCAPTURE Homer

Get notified when new releases ship.

About SIPCAPTURE Homer

Troubleshooting and monitoring VoIP calls.