CVE-2019-15939: Divide By Zero in OpenCV

Background

OpenCV is an open-source computer vision library that provides various algorithms and functions for image and video processing. It is widely used in applications such as robotics, surveillance, and augmented reality. OpenCV-Python is a Python wrapper for the OpenCV library, allowing developers to utilize its functionality in Python-based projects. However, OpenCV 4.1.0 (OpenCV-Python 4.1.0.25) is affected by a divide-by-zero error in the cv::HOGDescriptor::getDescriptorSize function in the hog.cpp file of the objdetect module.

Vulnerability Detail

The divide-by-zero vulnerability in OpenCV can be exploited by an attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code. The issue originates from a lack of proper input validation, allowing a divisor value of zero to be used in a calculation. As a result, a division operation triggers a divide-by-zero error, leading to a crash or unexpected behavior of the application using the vulnerable OpenCV version.

pip install --upgrade "opencv-python==5.0.0.93"

pip install --upgrade "opencv-python==4.1.1.26"

Workaround

If updating the OpenCV-Python package is not immediately feasible, a temporary workaround is to implement input validation before using the cv::HOGDescriptor::getDescriptorSize function. Developers can check if the divisor value is zero and handle the condition appropriately to prevent the divide-by-zero error. Here is an example of how to add input validation in Python:

def get_descriptor_size(hog_descriptor):
    if hog_descriptor.divisor == 0:
        # Handle the divide-by-zero condition
        return 0
    else:
        return hog_descriptor.getDescriptorSize()

Conclusion

In conclusion, OpenCV 4.1.0 (OpenCV-Python 4.1.0.25) is affected by a divide-by-zero vulnerability in the cv::HOGDescriptor::getDescriptorSize function. This vulnerability can result in a denial of service or potential execution of arbitrary code. It is crucial to update the OpenCV-Python package to version 4.1.1.26 or later to mitigate the risk. If immediate update is not possible, implementing input validation can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for opencv-python →

FAQ