[Vulnerable] upgrade opencv
- Dominant language
- C++
- Stars
- 37
- Forks
- 33
- PR merge metrics
- No merged PRs in 30d
Description
**Issue Description**
com.intel.analytics.bigdl:bigdl directly or transitively depends on 11 C libraries (.so). However, I noticed that some C libraries are vulnerable, containing the following CVEs:
libopencv_java320.sofrom C project opencv(version:3.2.0) exposed 18 vulnerabilities:
[CVE-2019-15939](https://nvd.nist.gov/vuln/detail/CVE-2019-15939), [CVE-2019-14491](https://nvd.nist.gov/vuln/detail/CVE-2019-14491), [CVE-2019-14493](https://nvd.nist.gov/vuln/detail/CVE-2019-14493), [CVE-2019-14492](https://nvd.nist.gov/vuln/detail/CVE-2019-14492), [CVE-2017-1000450](https://nvd.nist.gov/vuln/detail/CVE-2017-1000450), [CVE-2017-12863](https://nvd.nist.gov/vuln/detail/CVE-2017-12863), [CVE-2017-12862](https://nvd.nist.gov/vuln/detail/CVE-2017-12862), [CVE-2017-12864](https://nvd.nist.gov/vuln/detail/CVE-2017-12864), [CVE-2017-12604](https://nvd.nist.gov/vuln/detail/CVE-2017-12604), [CVE-2017-12597](https://nvd.nist.gov/vuln/detail/CVE-2017-12597), [CVE-2017-12606](https://nvd.nist.gov/vuln/detail/CVE-2017-12606), [CVE-2017-12605](https://nvd.nist.gov/vuln/detail/CVE-2017-12605), [CVE-2017-12598](https://nvd.nist.gov/vuln/detail/CVE-2017-12598), [CVE-2017-12600](https://nvd.nist.gov/vuln/detail/CVE-2017-12600), [CVE-2017-12599](https://nvd.nist.gov/vuln/detail/CVE-2017-12599), [CVE-2017-12602](https://nvd.nist.gov/vuln/detail/CVE-2017-12602), [CVE-2017-12601](https://nvd.nist.gov/vuln/detail/CVE-2017-12601), [CVE-2017-12603](https://nvd.nist.gov/vuln/detail/CVE-2017-12603)
**Solution**
Possible steps:
1. install opencv 4.2.0 `wget https://github.com/opencv/opencv/archive/4.2.0.tar.gz` on release environment
2. replace dependency in pom.xml https://github.com/intel-analytics/BigDL-core/blob/master/opencv/opencv-java-x86_64-linux/pom.xml#L17-L20
3. compile and mvn test UT
4. release bigdl-core 2.1.0-snapshot
5. Update bigdl-core version in BigDL-dllib. Finish the whole BigDL jenkins test
Release on mac when mac machine is recovered.
Contributor guide
Assessment
This issue has not been assessed yet.