CVE-2017-1000450 (High) detected in opencv.net.3.3.1.nupkg

[mend-bolt-for-github]

CVE-2017-1000450 - High Severity Vulnerability

Vulnerable Library - opencv.net.3.3.1.nupkg

A .NET interface for the popular OpenCV computer vision and image processing library.

Library home page: https://api.nuget.org/packages/opencv.net.3.3.1.nupkg

Path to dependency file: /NetFabric.Vision/src/NetFabric.Vision/NetFabric.Vision.csproj

Path to vulnerable library: /NetFabric.Vision/src/NetFabric.Vision/NetFabric.Vision.csproj

Dependency Hierarchy:

• ❌ opencv.net.3.3.1.nupkg (Vulnerable Library)

Found in HEAD commit: d1757d4b744ef49b8c5a9d943c8bc69fc6c237d7

Vulnerability Details

In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.

Publish Date: 2018-01-02

URL: CVE-2017-1000450

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: opencv/opencv@aacae20#diff-c868f69925dd124c54190546d4843841

Release Date: 2017-08-23

Fix Resolution: Replace or update the following files: grfmt_sunras.cpp, grfmt_jpeg.cpp, grfmt_pam.cpp, utils.hpp, grfmt_bmp.cpp, grfmt_exr.cpp, grfmt_jpeg2000.cpp, utils.cpp

---

Step up your Open Source Security Game with WhiteSource here