Bug 1797445 (CVE-2019-14492)

Summary: CVE-2019-14492 opencv: out-of-bounds read in function HaarEvaluator::OptFeature::calc() in cascadedetect.hpp leading to DoS
Product: [Other] Security Response Reporter: Dhananjay Arunesh <darunesh>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: andrew, databases-maint, hhorak, jkucera, jmlich83, jridky, karlthered, kwizart, pkajaba, rakesh.pandit, viktor.vix.jancik
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: opencv 3.4.7, opencv 4.1.1 Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds read flaw was found in OpenCV in the way the Cascade Classifier algorithm loaded and processed the Haar feature-based cascade classifiers. This flaw allows a remote attacker to provide a specially crafted classifier in the form of an XML file that, when loaded by an application linked to OpenCV, would crash the application, causing a denial of service.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-28 08:10:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1797447, 1824135, 1824136    
Bug Blocks: 1797452    

Description Dhananjay Arunesh 2020-02-03 08:02:23 UTC
An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.


Comment 1 Dhananjay Arunesh 2020-02-03 08:03:43 UTC
Created opencv tracking bugs for this issue:

Affects: fedora-all [bug 1797447]

Comment 2 Mauro Matteo Cascella 2020-04-15 09:12:54 UTC
Upstream fix:

Comment 6 Mauro Matteo Cascella 2020-04-15 15:04:07 UTC

The versions of OpenCV as shipped with Red Hat Enterprise Linux 7 and 8 are affected by this flaw. Although it's technically possible that classifiers are loaded from untrusted sources, this is probably an unlikely case in practice.

Comment 7 Mauro Matteo Cascella 2020-04-15 15:04:10 UTC

Avoid loading cascade classifiers from external untrusted sources.

Comment 8 Nicolas Chauvet (kwizart) 2020-07-28 08:10:15 UTC
Fixed in 3.4.10-1 package in f31