opencv / opencv/opencv-python

FFmpeg OSS vulnerability CVE-2023-6605

Open
#1,118 12 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
5.4k
Forks
1k
Avg merge
22h 17m
Merged PRs (30d)
3

Description

In doing an open source scan on the latest opencv 4.11.0.86 from pypi , opencv-python-headless, the scanner detected FFmpeg with the following versions that have vulnerable versions with CVE-2023-6605:

  • /opencv_python_headless.libs/libavcodec.so with FFmpeg version n5.1.6
  • /cv2/opencv_videoio_ffmpeg4110_.dll version n4.4.5

Can FFmpeg be updated to the latest?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how the precompiled wheels include /opencv_python_headless.libs/libavcodec.so and /cv2/opencv_videoio_ffmpeg4110_.dll, noting the reported FFmpeg versions. Check the wheel build inputs and dependency update process, then verify rebuilt packages no longer contain versions affected by CVE-2023-6605.

Written by the indexing model from the issue text.

Assessment

Tech stack
opencv, python
Domain
build-system, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.