p PatchFirst

CVE-2024-32874

CVE-2024-32874 · In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.

CVSS 6.8 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • frigate

    Versions
    • <= 0.13.2: Affected

    No fix published

  • frigate PyPI

    Versions
    • 0.1.0
    • 0.2.0
    • 0.3.0
    • 0.4.0
    • 0.4.0a0
    • 0.4.0a0.post0.dev14
    • 0.5.0
    • 0.5.0a0
    • 0.5.0a0.post0.dev2
    • 0.5.0a0.post0.dev3
    • 0.5.0a0.post0.dev4
    • 0.5.0a0.post0.dev7
    • 0.5.0a0.post0.dev8
    • 0.6.0
    • 0.6.0a0
    • 0.6.0a0.post0.dev2
    • 0.6.0a0.post0.dev3
    • 0.6.0a0.post0.dev4
    • 0.6.1
    • 0.7.0
    • 0.7.0a0
    • 0.7.0a0.post0.dev1
    • 0.7.0a0.post0.dev32
    • 0.7.0a0.post0.dev34
    • 0.7.0a0.post0.dev37
    • 0.7.0a0.post0.dev38
    • 0.8.0a0.post0.dev39
    • 0.8.0a0.post0.dev40
    • 0.8.0a0.post0.dev41
    Affected ranges
    • ECOSYSTEM: < 0.13.2

    Update to 0.13.2

Original sources

Check your server →