Out of Bounds Read/Write Vulnerability in OpenCV - Denial of Service Risk
Summary
CVE-2019-14492: An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. Affects opencv across 3 version ranges.
< 4.1.2+dfsg-3
< 4a7ca5a291038a773ea0b67eaf6fbed9ad72170b
< 6d656ca069afb3a3cb43a3484ee3a2d215982997
Fixed in 4.1.2+dfsg-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It is widely used for real-time image processing and analysis. The library includes various functionalities such as image manipulation, object detection, and machine learning algorithms. However, prior to versions 3.4.7 and 4.1.1, OpenCV contained a critical vulnerability that could lead to denial of service due to improper handling of certain inputs.
Vulnerability Detail
An issue was discovered in OpenCV before version 3.4.7 and 4.x before 4.1.1. The vulnerability is located in the HaarEvaluator::OptFeature::calc function within the cascadedetect.hpp file. This flaw allows for out of bounds read/write operations, which can be exploited to cause a denial of service. Attackers can leverage this vulnerability to crash the application or potentially execute arbitrary code, leading to significant security risks.
How To Fix
Minimum fixed version
4.1.2+dfsg-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to ensure that the data being processed does not trigger the out of bounds read/write conditions. This can involve checking the dimensions and types of input data before processing.
Conclusion
The vulnerability identified in OpenCV poses a significant risk to applications using the library. It is crucial for users to upgrade to the fixed versions to mitigate potential denial of service attacks. Regular monitoring and validation of software dependencies can help maintain security.
See every vulnerability recorded for opencv →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
OpenCV versions before 3.4.7 and 4.x before 4.1.1 are affected by this vulnerability.
If left unaddressed, this vulnerability can lead to denial of service, crashing applications, and potential exploitation by attackers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
