GHSA-cxjf-x6jp-p7mc: opencv-contrib-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
opencv-contrib-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.
References
- github.com/advisories/GHSA-cxjf-x6jp-p7mc
- github.com/advisories/GHSA-j7hp-h8jx-5ppr
- github.com/opencv/opencv-python
- github.com/opencv/opencv/commit/687fc11626901cff09d2b3b5f331fd59190ad4c7
- github.com/opencv/opencv/pull/24274
- github.com/opencv/opencv/wiki/ChangeLog
- github.com/pypa/advisory-database/tree/main/vulns/opencv-contrib-python/PYSEC-2023-181.yaml
- nvd.nist.gov/vuln/detail/CVE-2023-4863
Code Behaviors & Features
Detect and mitigate GHSA-cxjf-x6jp-p7mc with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →