CVE-2019-5063: Out-of-bounds Write in OpenCV
Summary
CVE-2019-5063: Out-of-bounds Write in OpenCV. Affects opencv-python versions < 4.1.0.25. No fix is published. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv-python-headless · PyPI
- opencv-contrib-python-headless · PyPI
- opencv · Debian:11
The same CVE-2019-5063 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision library widely used for image and video processing tasks. It provides various functions and algorithms for image manipulation, object detection, and machine learning. OpenCV-Python is a Python wrapper for the OpenCV library, allowing developers to utilize OpenCV functionalities in Python applications. However, OpenCV 4.1.0 (corresponding with OpenCV-Python 4.1.0.25) is affected by a critical vulnerability that can lead to a heap buffer overflow.
Vulnerability Detail
The vulnerability exists in the data structure persistence functionality of OpenCV. By providing a specially crafted XML file, an attacker can trigger a heap buffer overflow, resulting in multiple heap corruptions and potential code execution. This can lead to arbitrary code execution, allowing the attacker to take control of the affected system. The vulnerability has a CVSS score of 8.8, indicating its high severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can validate and sanitize any XML input before processing it with OpenCV. By implementing strict input validation, it is possible to prevent the exploitation of this vulnerability. Here is an example of input validation in Python:
import xml.etree.ElementTree as ET
def process_xml(xml_data):
try:
# Validate XML
ET.fromstring(xml_data)
# Process XML with OpenCV
# ...
except ET.ParseError:
# Handle invalid XML
# ...
Conclusion
The vulnerability in OpenCV-Python 4.1.0 (corresponding with OpenCV 4.1.0) allows an attacker to trigger a heap buffer overflow by providing a specially crafted XML file. This can lead to arbitrary code execution and potential compromise of the affected system. It is crucial to update to a patched version of OpenCV-Python and implement input validation to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to a complete compromise of the system.
OpenCV-Python versions up to and including 4.1.0.25 are affected by this vulnerability.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is crucial to apply the security patch to prevent any potential exploitation.
Implementing strict input validation and sanitization of XML input can help mitigate the risk of exploitation. Additionally, updating to a patched version of OpenCV-Python is highly recommended.
You can find more information about this vulnerability, including technical details and the security patch, in the advisory published on the GitHub Advisory Database: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
