Release Notes for market release
Scope of this document
This document applies to the following applications:
| Application | Application description |
|---|---|
Vision Connector MLFB 6AV2170-0KA80-0AA0 |
Vision Connector gives you the advantage of connecting to industrial ethernet cameras and transferring the acquired data via highspeed interface to Siemens Industrial Edge applications. The integrated UI and convenience of setting up the camera connectivity can open up many opportunities for your vision use cases. |
Each chapter is valid for both applications except for those statements where the MLFB numbers are explicitly stated.
Notice: Only one Vision Connector application instance can be installed on one Siemens Industrial Edge device.
Notice: The application has been virus scanned prior to publishing on Industrial Edge. The users who use camera driver plugins should also scan camera driver plugins with virus scanner before using it in Vision Connector application. The camera driver plugins should be only used from trusted sources. Siemens is not liable for any issues arising from usage of 3rd party camera connector plugins.
Versions
Version 1.1.0, 12/2024
Security
FFmpeg updated to 7.1
python-multipart updated to 0.0.12
urllib3 updated to 2.2.3
certifi updated to 2024.8.30
httptools updated to 0.6.4
starlette updated to 0.41.0
idna updated to 3.10
opencv-python-headless updated to 4.10.0.84
requests updated to 2.32.3
Jinja2 updated to 3.1.4
Breaking changes
No breaking change introduced
Added
Custom camera connector support
Managing camera connectors
Add, remove, update and download custom camera connector
Using cameras through custom camera connectors
Changed
No existing functionality changed
Fixed
Incorrect preview image of the same camera
Deprecated
No deprecated functionalities, APIs
Removed
No functionality removed
Version 1.0.3, 10/2024
Security
OpenCV updated: libopencv-dev 4.5.1 package is replaced by manually built OpenCV 4.9.0 and FFmpeg 6.1.1
Python Package: Werkzeug < 3.0.3 - Remote Code Execution Vulnerability
Angular 15.x, 16.x - End of Life Notification (EOL) - Updated to Angular 17.x
Breaking changes
No breaking change introduced
Added
No new functionality added
Changed
No existing functionality changed
Fixed
Reduced PTP timestamp 0 occurrences by optimizing camera network communication
Network Failure Handling - In the event of a network failure, some parameters (including the trigger mode) are reset to default user-set. When a user-set change is detected during a reconnection to the camera, the previous user set is restored.
Techincal issue is fixed with the synchronize_running_pipelines command
Deprecated
No deprecated functionalities, APIs
Removed
No functionality removed
Version 1.0.0, 02/2024
Security
No security update introduced
Breaking changes
No breaking change is introduced
Added
Add, Delete, Enable, Disable camera on UI
Configure Acquisition Parameters
Acquisition Frame Rate, Resolution, Pixel Format, Exposure Time, height, width, Gain, Set/Unset S/W Trigger
Config file validation
Camera Support
Industrial Cameras (with ethernet interface)
RTSP Camera
Camera Auto discovery
Visualization
Stream images on UI
Preview image
Logs
Live parameter change
Changed
No existing functionality is changed
Fixed
No bugfix introduced
Deprecated
No deprecated functionalities, APIs
Removed
No functionality is removed
Limitations and known issues
Supported cameras You can find a list of supported and tested cameras in the specification sheet document.
Performance limits Refer to the specification sheet document for performance limitations and more information.
CTI files are not supported The CTI GenICam Connector is currently not supported in Vision Connector.
USB USB camera are not supported by the Vision Connector.
Accessing camera Vision connector provides images to external applications via ZeroMQ. MQTT Databus is not supported by Vision Connector.
Network limitation error The network has to be configured properly to have adequate capacity for data traffic. If the network is unable to manage the data effectively, the camera(s) will not be able to provide images. If there are no images in the "Camera Stream" view after enabling the camera, check the logs for network error.
The most commonly logged error in case of bad network configuration is the following: "The buffer was incompletely grabbed. This can be caused by performance problems of the network hardware used, i.e. network adapter, switch, or ethernet cable. To fix this, try increasing the camera's Inter-Packet Delay in the Transport Layer category to reduce the required bandwidth, and adjust the camera's Packet Size setting to the highest supported frame size."
Virtual IED not supported The Vision Connector (VCA) supports only physical Industrial Edge Device (IED). Virtual devices are not supported.
Frame loss during camera acquisition Under certain camera setup conditions (hardware triggered, non-optimal network, multiple cameras) frame loss is possible and logged in log file. By reducing camera network communication during image acquisition the overall stability is improved and frame loss is experienced less frequently.
Sporadic issues with timestamp value Under certain network conditions, a 0 timestamp value may sporadically be produced. This issue has been observed when PTP is enabled and the cameras are triggered using a hardware trigger. By reducing camera network communication during image acquisition the overall stability is improved and timestamp 0 occurs less frequently.
Installation exclusivity The Vision Connector and VCASim applications cannot be installed on the same Industrial Edge Device at the same time.
Vulnerabilities
The following vulnerabilities are included via 3rd party software components in the Vision Connector 1.1.0 version:
| Vendor | Component Name | Version | Risk Description |
|---|---|---|---|
| Andrew Dunham | Python Package: python-multipart | 0.0.12 | python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed in 0.0.18. : https://nvd.nist.gov/vuln/detail/CVE-2024-53981 |
| The Pallets Projects (by Armin Ronacher) | Python Package: Jinja2 | 3.1.4 | Jinja is an extensible templating engine. Prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5. : https://nvd.nist.gov/vuln/detail/CVE-2024-56201 |
| Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5. : https://nvd.nist.gov/vuln/detail/CVE-2024-56326 | |||
| The Pallets Projects (by Armin Ronacher) | Python Package: Werkzeug | 3.0.3 | Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch. : https://nvd.nist.gov/vuln/detail/CVE-2024-49766 |
Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parse multipart/form-data requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue. : https://nvd.nist.gov/vuln/detail/CVE-2024-49767 |
Restricted / Copyright © 2024 Siemens Aktiengesellschaft – All rights reserved.
Copying or distribution or communication of the contents of this document are not allowed unless with express written permission from Siemens.