Vulnerabilities in pkg:pypi/opencv-contrib-python-headless
PACKAGEGHSA-w2pj-9cgh-mq2c is a HIGH (CVSS 8.8) opencv-contrib-python-headless bundled libwebp binaries vulnerability (CWE-787: Out-of-bounds Write) affecting Opencv contrib python headless libraries in the PyPI ecosystem. The issue involves opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to cve-2023-4863. Remediation is available by upgrading affected packages to version 4.8.1.78.
pkg:pypi/opencv-contrib-python-headless
Vulnerability advisories affecting package pkg:pypi/opencv-contrib-python-headless. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-w2pj-9cgh-mq2c | - | HIGH | opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863 |
| GHSA-m6vm-8g8v-xfjh | CVE-2019-5063 | HIGH | Out-of-bounds Write in OpenCV |
| GHSA-hxfw-jm98-v4mq | CVE-2019-15939 | MODERATE | Divide By Zero in OpenCV. |
| GHSA-3448-vrgh-85xr | CVE-2019-14493 | HIGH | NULL Pointer Dereference in OpenCV. |
| GHSA-fm39-cw8h-3p63 | CVE-2019-14491 | HIGH | Out-of-bounds Read in OpenCV |
| GHSA-fw99-f933-rgh8 | CVE-2019-14492 | HIGH | Out-of-bounds Read and Out-of-bounds Write in OpenCV |
| GHSA-x3rm-644h-67m8 | CVE-2019-16249 | MODERATE | Out-of-bounds Read in OpenCV |
| GHSA-8849-5h85-98qw | CVE-2019-9423 | HIGH | Out-of-bounds Write in OpenCV |
| GHSA-jggw-2q6g-c3m6 | CVE-2019-19624 | MODERATE | Out-of-bounds Read in OpenCV |
| GHSA-q799-q27x-vp7w | CVE-2019-5064 | HIGH | Out-of-bounds Write in OpenCV |
GHSA-w2pj-9cgh-mq2c at a Glance
Security Impact
CVSS: 8.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
How to Fix GHSA-w2pj-9cgh-mq2c
To remediate this vulnerability, upgrade all affected Opencv contrib python headless dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install opencv-contrib-python-headless>=4.8.1.78Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show opencv-contrib-python-headlessHow to Check if You Are Affected
To determine whether your Python environment is affected by GHSA-w2pj-9cgh-mq2c, inspect your installed packages using pip:
pip show opencv-contrib-python-headlessAnalyze the terminal output to locate any version of Opencv contrib python headless in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.8.1.78), your application is affected.
Note: The pip show opencv-contrib-python-headless command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-787: Out-of-bounds Write, where the product writes data past the end, or before the beginning, of the intended buffer. In Opencv contrib python headless, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-w2pj-9cgh-mq2c Affected Opencv contrib python headless Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
opencv-contrib-python-headless
|
PyPI |
< 4.8.1.78
|
4.8.1.78
|
References
Frequently Asked Questions
What is GHSA-w2pj-9cgh-mq2c?
Which Opencv contrib python headless versions are affected?
What version fixes GHSA-w2pj-9cgh-mq2c?
Is opencv-contrib-python-headless affected?
What is the CVSS score of GHSA-w2pj-9cgh-mq2c?
What CWE is associated with GHSA-w2pj-9cgh-mq2c?
How can I check PyPI dependencies for GHSA-w2pj-9cgh-mq2c?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-w2pj-9cgh-mq2c",
"modified" : "2024-08-30T23:37:14Z",
"published" : "2024-08-30T23:37:14Z",
"aliases" : [ ],
"summary" : "opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863",
"details" : "opencv-contrib-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python-headless v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "opencv-contrib-python-headless"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.8.1.78"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-4863"
}, {
"type" : "WEB",
"url" : "https://github.com/opencv/opencv/pull/24274"
}, {
"type" : "WEB",
"url" : "https://github.com/opencv/opencv/commit/687fc11626901cff09d2b3b5f331fd59190ad4c7"
}, {
"type" : "ADVISORY",
"url" : "https://github.com/advisories/GHSA-j7hp-h8jx-5ppr"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/opencv/opencv-python"
}, {
"type" : "WEB",
"url" : "https://github.com/opencv/opencv/wiki/ChangeLog#version481"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/opencv-contrib-python-headless/PYSEC-2023-182.yaml"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-787" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2024-08-30T23:37:14Z",
"nvd_published_at" : null
}
}