Executive brief
OpenCV is a widely-used computer vision library that processes images and video. A NULL pointer dereference vulnerability in its XML file parser can cause applications using OpenCV to crash when processing malformed XML files, resulting in denial of service.
Technical details
This vulnerability is a NULL pointer dereference (CWE-476) in the cv::XMLParser::parse function within the XML persistence module (persistence_xml.cpp). The vulnerability occurs when the parser fails to properly validate pointer bounds during XML tag parsing, leading to dereferencing a null pointer. Exploitation requires supplying a malformed XML file to an application that uses OpenCV's FileStorage XML parsing functionality; no authentication or special privileges are required. An attacker can trigger an application crash, causing denial of service. The vulnerability affects OpenCV versions before 4.1.1, and a patch is available in version 4.1.1 and later.
Affected products
- OpenCV opencv-python 3.4.0.14 through 4.1.0.25
- OpenCV opencv-python-headless 3.4.3.18 through 4.1.0.25
- OpenCV opencv-contrib-python 3.4.2.17 through 4.1.0.25
- OpenCV opencv-contrib-python-headless 3.4.0.14 through 4.1.0.25
Timeline
- 2019-07-23: disclosed: Vulnerability reported on GitHub issue #15127
- 2019: patched: Fixed in OpenCV 4.1.1 and later
- 2021-10-12: advisory: Published in GitHub Advisory Database as GHSA-3448-vrgh-85xr