Spectra Assure

warningRisk: Vulnerabilities

Scanned:

opencv-python-headless

Artifact:

latest

Top 1k

Wrapper package for OpenCV python bindings.

License: Permissive (Apache-2.0)

Published:

Visit GitHub

See on PyPI

SAFE Assessment

Compliance

Licenses

1 weak copyleft linked components

Secrets

No sensitive information found

Security

Vulnerabilities

1 medium severity vulnerabilities

Hardening

1 modern mitigations missing

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

Overview issues9 vulnerabilities1 malware0 behaviors117 dependencies2 contributors6 versions63

List of software quality issues with the number of affected components.

Policies

Info

Problem

Sensitive executable memory regions should be kept as read-only to protect the integrity of trusted execution code flow paths. Imported function addresses are pointers to the symbols that implement the application-required functionality. If those pointers are changed by malicious code, execution paths can be redirected to unintended locations. Most modern programming language toolchains protect those memory regions appropriately. These issues are commonly reported for outdated linkers and non-compliant executable packing solutions.

Prevalence in PyPI community

15 packages

found in

Top 100

29 packages

found in

Top 1k

165 packages

found in

Top 10k

3.83k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Sensitive executable memory regions should be kept as read-only to protect the integrity of trusted execution code flow paths. Thread local storage (TLS) callbacks are pointers to code initialization and resource release functions. If those pointers are changed by malicious code, execution paths can be redirected to unintended locations. Most modern programming language toolchains protect those memory regions appropriately. These issues are commonly reported for outdated linkers and non-compliant executable packing solutions.

Prevalence in PyPI community

7 packages

found in

Top 100

16 packages

found in

Top 1k

121 packages

found in

Top 10k

3.03k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Weak copyleft licenses in particular impose requirements that the user must be able to replace or update the code they apply to. In practical terms, that means the object and library files that statically link to weak copyleft code must be made available publicly. For commercial applications, this is typically undesirable. Therefore, statically linking to weak copyleft code is commonly avoided or even prohibited by the organization policy. Instead of linking statically to weak copyleft licensed code, it is recommended to isolate such code into modules that the publisher-developed, first-party code can dynamically link to without the aforementioned obligations.

Prevalence in PyPI community

1 packages

found in

Top 100

19 packages

found in

Top 1k

106 packages

found in

Top 10k

1.34k packages

in community

Next steps

Confirm that the software package statically links to a weak copyleft dependency.

Investigate if the software publisher provides this dependency under a non-copyleft license.

Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.

Alternatively, repackage the code so that it dynamically links to a weak copyleft dependency.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on software distribution of the code they apply to. These restrictions may extend to the services built upon the code licensed under such restrictive licenses. Some restrictive licenses explicitly state that the licensee may not provide the software to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features or functionality of the licensed software. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on software distribution is commonly avoided or even prohibited by the organization policy.

Prevalence in PyPI community

7 packages

found in

Top 100

82 packages

found in

Top 1k

1208 packages

found in

Top 10k

109.57k packages

in community

Next steps

Confirm that the software package references a component or a dependency with a restrictive license.

Consider replacing the software component with an alternative that offers a license compatible with organization policy.

Problem

Security Development Lifecycle (SDL) is a group of enhanced compile-time checks that report common coding mistakes as errors, preventing them from reaching production. These checks minimize the number of security issues by enforcing strict memory access checks. They also prevent the use of hard-to-secure string and memory manipulation functions. To prove the binary has been compiled with these checks enabled, the compiler emits a special debug object. Removing the debug table eliminates this proof. Therefore, this check only applies to binaries that still have their debug tables.

Prevalence in PyPI community

12 packages

found in

Top 100

63 packages

found in

Top 1k

326 packages

found in

Top 10k

7.08k packages

in community

Next steps

You should keep the debug table to prove that the SDL process has been followed.

To enable these checks, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable this feature by setting the compiler option /SDL to ON.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Prevalence in PyPI community

36 packages

found in

Top 100

209 packages

found in

Top 1k

1750 packages

found in

Top 10k

81.53k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Prevalence in PyPI community

29 packages

found in

Top 100

114 packages

found in

Top 1k

525 packages

found in

Top 10k

8.89k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Control Flow Guard (CFG/CFI) protects the code flow integrity by ensuring that dynamic calls are made only to vetted functions. Trusted execution paths rely on the ability of the operating system to build a list of valid function targets. Certain functions can intentionally be disallowed to prevent malicious code from deactivating vulnerability mitigation features. A list of such invalid function targets can include publicly exported symbols. Applications that enhance control flow integrity through export suppression rely on libraries to mark their publicly visible symbols as suppressed. This is done for all symbols that are considered to be sensitive functions, and to which access should be restricted. It is considered dangerous to mix applications that perform export suppression with libraries that do not.

Prevalence in PyPI community

30 packages

found in

Top 100

143 packages

found in

Top 1k

833 packages

found in

Top 10k

15.19k packages

in community

Next steps

To enable this mitigation on library code, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Control Flow Guard (CFG/CFI) protects the code flow integrity by ensuring that indirect calls are made only to vetted functions. This mitigation protects dynamically resolved function targets by instrumenting the code responsible for transferring execution control. Higher-level programming languages implement structured exception handling by managing their own code flow execution paths. As such, they are subject to code flow hijacking during runtime. Language-specific exception handling mitigation enforces execution integrity by instrumenting calls to manage execution context switching. Any deviation from the known and trusted code flow paths will cause the application to terminate. This makes malicious code less likely to execute.

Prevalence in PyPI community

36 packages

found in

Top 100

164 packages

found in

Top 1k

932 packages

found in

Top 10k

17.86k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in PyPI community

15 packages

found in

Top 100

29 packages

found in

Top 1k

165 packages

found in

Top 10k

3.83k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Prevalence in PyPI community

7 packages

found in

Top 100

16 packages

found in

Top 1k

121 packages

found in

Top 10k

3.03k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

19 packages

found in

Top 1k

106 packages

found in

Top 10k

1.34k packages

in community

Next steps

Confirm that the software package statically links to a weak copyleft dependency.

Investigate if the software publisher provides this dependency under a non-copyleft license.

Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.

Alternatively, repackage the code so that it dynamically links to a weak copyleft dependency.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on software distribution of the code they apply to. These restrictions may extend to the services built upon the code licensed under such restrictive licenses. Some restrictive licenses explicitly state that the licensee may not provide the software to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features or functionality of the licensed software. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on software distribution is commonly avoided or even prohibited by the organization policy.

Prevalence in PyPI community

7 packages

found in

Top 100

82 packages

found in

Top 1k

1208 packages

found in

Top 10k

109.57k packages

in community

Next steps

Confirm that the software package references a component or a dependency with a restrictive license.

Consider replacing the software component with an alternative that offers a license compatible with organization policy.

Problem

Prevalence in PyPI community

12 packages

found in

Top 100

63 packages

found in

Top 1k

326 packages

found in

Top 10k

7.08k packages

in community

Next steps

You should keep the debug table to prove that the SDL process has been followed.

To enable these checks, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable this feature by setting the compiler option /SDL to ON.

Problem

Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as medium severity.

Prevalence in PyPI community

36 packages

found in

Top 100

209 packages

found in

Top 1k

1750 packages

found in

Top 10k

81.53k packages

in community

Next steps

Perform impact analysis for the reported CVEs.

Update the component to the latest version.

If the update can't resolve the issue, create a plan to isolate or replace the affected component.

Problem

Prevalence in PyPI community

29 packages

found in

Top 100

114 packages

found in

Top 1k

525 packages

found in

Top 10k

8.89k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Prevalence in PyPI community

30 packages

found in

Top 100

143 packages

found in

Top 1k

833 packages

found in

Top 10k

15.19k packages

in community

Next steps

To enable this mitigation on library code, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Prevalence in PyPI community

36 packages

found in

Top 100

164 packages

found in

Top 1k

932 packages

found in

Top 10k

17.86k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

opencv-python-headless

SAFE Assessment

Compliance

Security

Threats

SQ14156Detected Windows executable files with imported functions susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in PyPI community

Next steps

SQ14158Detected Windows executable files with TLS callbacks susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in PyPI community

Next steps

SQ12103Detected presence of statically linked dependencies distributed with weak copyleft licenses.Causes risk: weak copyleft linked componentslicenses

Problem

Prevalence in PyPI community

Next steps

SQ12405Detected presence of licenses that place restrictions on software distribution.Causes risk: software distribution restrictionslicenses

Problem

Prevalence in PyPI community

Next steps

SQ14138Detected Windows executable files that were compiled without following the recommended SDL process.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps

SQ31106Detected presence of medium severity vulnerabilities.Causes risk: medium severity vulnerabilitiesvulnerabilities

Problem

Prevalence in PyPI community

Next steps

SQ14122Detected Windows executable files that do not implement CFG vulnerability mitigation protection.Causes risk: modern mitigations missinghardening

Problem

Prevalence in PyPI community

Next steps

SQ14125Detected Windows shared library files that do not suppress exports which reduces CFG vulnerability mitigation protection effectiveness.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps

SQ14127Detected Windows executable files that do not implement long jump control flow vulnerability mitigation protection.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps

Did you know...

SQ14156Detected Windows executable files with imported functions susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in PyPI community

Next steps

SQ14158Detected Windows executable files with TLS callbacks susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in PyPI community

Next steps

SQ12103Detected presence of statically linked dependencies distributed with weak copyleft licenses.Causes risk: weak copyleft linked componentslicenses

Problem

Prevalence in PyPI community

Next steps

SQ12405Detected presence of licenses that place restrictions on software distribution.Causes risk: software distribution restrictionslicenses

Problem

Prevalence in PyPI community

Next steps

SQ14138Detected Windows executable files that were compiled without following the recommended SDL process.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in PyPI community

Next steps

SQ31106Detected presence of medium severity vulnerabilities.Causes risk: medium severity vulnerabilitiesvulnerabilities

Problem

Prevalence in PyPI community

Next steps

SQ14122Detected Windows executable files that do not implement CFG vulnerability mitigation protection.Causes risk: modern mitigations missinghardening

Problem

Prevalence in PyPI community

Next steps

SQ14125Detected Windows shared library files that do not suppress exports which reduces CFG vulnerability mitigation protection effectiveness.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps

SQ14127Detected Windows executable files that do not implement long jump control flow vulnerability mitigation protection.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps