CVE-2019-14491 Out-of-bounds Read in OpenCV

What is CVE-2019-14491?

CVE-2019-14491 is a high-severity denial of service vulnerability in n/a, published on 1 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.

Weakness: CWE-125

Which versions are affected by CVE-2019-14491?

20 open source packages ship an affected version, including opencv-contrib-python, opencv-contrib-python-headless and opencv-python. It affects 1 product.

Products include Opencv Opencv.

How do I fix CVE-2019-14491?

Upgrade opencv-contrib-python to a fixed version for your release line: 3.4.7.28 or 4.1.1.26.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-14491 being exploited?

There is no known exploitation of CVE-2019-14491 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-5063 Out-of-bounds Write in OpenCV High 8.8
• CVE-2019-5064 Out-of-bounds Write in OpenCV High 8.8
• CVE-2019-14492 Out-of-bounds Read and Out-of-bounds Write in OpenCV High 7.5
• CVE-2018-7712 Denial of service in n/a High 7.5
• CVE-2018-7713 Denial of service in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-14491, GHSA-fm39-cw8h-3p63, PYSEC-2026-2797, PYSEC-2026-2818, PYSEC-2026-2836, PYSEC-2026-720 and 1 more.