This is a maintenance release for Frigate 0.18 that includes some security fixes.
Images
- ghcr.io/blakeblackshear/frigate:0.18.2
- ghcr.io/blakeblackshear/frigate:0.18.2-standard-arm64
- ghcr.io/blakeblackshear/frigate:0.18.2-tensorrt
- ghcr.io/blakeblackshear/frigate:0.18.2-rk
- ghcr.io/blakeblackshear/frigate:0.18.2-rocm
- ghcr.io/blakeblackshear/frigate:0.18.2-tensorrt-jp6
- ghcr.io/blakeblackshear/frigate:0.18.2-synaptics
What's Changed
Security Fixes
- source scheme bypasses go2rtc exec-filter in Frigate allowing admin-authenticated RCE as root (GHSA-qjjw-3v66-279f)
- direct websocket paths allows viewers to perform RCE as root (GHSA-93xj-hg88-ffg7)
- the /auth media and stream checks classify the raw request path, not the one nginx serves (GHSA-3cxh-fj2f-h497)
What's Changed
- Security patches by @blakeblackshear in #24658
- Normalize request paths in media auth by @hawkeye217 in #24662
Full Changelog: v0.18.1...v0.18.2