GHSA-w2pj-9cgh-mq2c: opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
opencv-contrib-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python-headless v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.
References
- github.com/advisories/GHSA-j7hp-h8jx-5ppr
- github.com/advisories/GHSA-w2pj-9cgh-mq2c
- github.com/opencv/opencv-python
- github.com/opencv/opencv/commit/687fc11626901cff09d2b3b5f331fd59190ad4c7
- github.com/opencv/opencv/pull/24274
- github.com/opencv/opencv/wiki/ChangeLog
- github.com/pypa/advisory-database/tree/main/vulns/opencv-contrib-python-headless/PYSEC-2023-182.yaml
- nvd.nist.gov/vuln/detail/CVE-2023-4863
Code Behaviors & Features
Detect and mitigate GHSA-w2pj-9cgh-mq2c with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →