CVE-2024-32874
Medium
Description
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the form NFKD under the hood of `secure_filename()`.
SeverityMedium
CVSS6.8
Exploit probability—
ProductFrigate
PublishedMay 14, 2024
First seenMay 14, 2024
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- frigate0.13.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| frigatePyPI | v < 0.13.2 | 0.13.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.