0.18.2 Release

This is a maintenance release for Frigate 0.18 that includes some security fixes.

Images

• ghcr.io/blakeblackshear/frigate:0.18.2
• ghcr.io/blakeblackshear/frigate:0.18.2-standard-arm64
• ghcr.io/blakeblackshear/frigate:0.18.2-tensorrt
• ghcr.io/blakeblackshear/frigate:0.18.2-rk
• ghcr.io/blakeblackshear/frigate:0.18.2-rocm
• ghcr.io/blakeblackshear/frigate:0.18.2-tensorrt-jp6
• ghcr.io/blakeblackshear/frigate:0.18.2-synaptics

What's Changed

Security Fixes

• source scheme bypasses go2rtc exec-filter in Frigate allowing admin-authenticated RCE as root (GHSA-qjjw-3v66-279f)
• direct websocket paths allows viewers to perform RCE as root (GHSA-93xj-hg88-ffg7)
• the /auth media and stream checks classify the raw request path, not the one nginx serves (GHSA-3cxh-fj2f-h497)

What's Changed

• Security patches by @blakeblackshear in #24658
• Normalize request paths in media auth by @hawkeye217 in #24662

Full Changelog: v0.18.1...v0.18.2