intel / intel/BigDL-core

[Vulnerable] upgrade opencv

Open
#157 3 comments 1 reaction 0 assignees View on GitHub
Dominant language
C++
Stars
37
Forks
33
PR merge metrics
No merged PRs in 30d

Description

**Issue Description**
com.intel.analytics.bigdl:bigdl directly or transitively depends on 11 C libraries (.so). However, I noticed that some C libraries are vulnerable, containing the following CVEs:

libopencv_java320.sofrom C project opencv(version:3.2.0) exposed 18 vulnerabilities:
[CVE-2019-15939](https://nvd.nist.gov/vuln/detail/CVE-2019-15939), [CVE-2019-14491](https://nvd.nist.gov/vuln/detail/CVE-2019-14491), [CVE-2019-14493](https://nvd.nist.gov/vuln/detail/CVE-2019-14493), [CVE-2019-14492](https://nvd.nist.gov/vuln/detail/CVE-2019-14492), [CVE-2017-1000450](https://nvd.nist.gov/vuln/detail/CVE-2017-1000450), [CVE-2017-12863](https://nvd.nist.gov/vuln/detail/CVE-2017-12863), [CVE-2017-12862](https://nvd.nist.gov/vuln/detail/CVE-2017-12862), [CVE-2017-12864](https://nvd.nist.gov/vuln/detail/CVE-2017-12864), [CVE-2017-12604](https://nvd.nist.gov/vuln/detail/CVE-2017-12604), [CVE-2017-12597](https://nvd.nist.gov/vuln/detail/CVE-2017-12597), [CVE-2017-12606](https://nvd.nist.gov/vuln/detail/CVE-2017-12606), [CVE-2017-12605](https://nvd.nist.gov/vuln/detail/CVE-2017-12605), [CVE-2017-12598](https://nvd.nist.gov/vuln/detail/CVE-2017-12598), [CVE-2017-12600](https://nvd.nist.gov/vuln/detail/CVE-2017-12600), [CVE-2017-12599](https://nvd.nist.gov/vuln/detail/CVE-2017-12599), [CVE-2017-12602](https://nvd.nist.gov/vuln/detail/CVE-2017-12602), [CVE-2017-12601](https://nvd.nist.gov/vuln/detail/CVE-2017-12601), [CVE-2017-12603](https://nvd.nist.gov/vuln/detail/CVE-2017-12603)

**Solution**
Possible steps:
1. install opencv 4.2.0 `wget https://github.com/opencv/opencv/archive/4.2.0.tar.gz` on release environment
2. replace dependency in pom.xml https://github.com/intel-analytics/BigDL-core/blob/master/opencv/opencv-java-x86_64-linux/pom.xml#L17-L20
3. compile and mvn test UT
4. release bigdl-core 2.1.0-snapshot
5. Update bigdl-core version in BigDL-dllib. Finish the whole BigDL jenkins test

Release on mac when mac machine is recovered.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.