CVE-2020-8927
15.09.2020, 10:15
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| brotli | 𝑥 < 1.0.8 | |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 20.04 |
| opensuse | leap | 15.2 |
| microsoft | .net | 5.0 ≤ 𝑥 ≤ 5.0.14 |
| microsoft | .net_core | 3.1 ≤ 𝑥 ≤ 3.1.22 |
| microsoft | powershell | 7.0 ≤ 𝑥 < 7.0.9 |
| microsoft | powershell | 7.1 ≤ 𝑥 < 7.1.6 |
| microsoft | powershell | 7.2 ≤ 𝑥 < 7.2.2 |
| microsoft | visual_studio_2019 | 16.0 ≤ 𝑥 ≤ 16.11 |
| microsoft | visual_studio_2022 | 17.0 ≤ 𝑥 ≤ 17.0.7 |
| microsoft | visual_studio_2022 | 17.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libbrotli-devel |
| ||||||||||||||||||||||||||||||||||||
| libbrotlicommon1 |
| ||||||||||||||||||||||||||||||||||||
| libbrotlicommon1-32bit |
| ||||||||||||||||||||||||||||||||||||
| libbrotlidec1 |
| ||||||||||||||||||||||||||||||||||||
| libbrotlidec1-32bit |
| ||||||||||||||||||||||||||||||||||||
| libbrotlienc1 |
| ||||||||||||||||||||||||||||||||||||
| python3-Brotli |
| ||||||||||||||||||||||||||||||||||||
| python3-brotlipy |
| ||||||||||||||||||||||||||||||||||||
| python311-Brotli |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||
|---|---|---|---|
| aspnetcore-runtime-3.1 |
| ||
| aspnetcore-runtime-5.0 |
| ||
| aspnetcore-targeting-pack-3.1 |
| ||
| aspnetcore-targeting-pack-5.0 |
| ||
| brotli |
| ||
| brotli-devel |
| ||
| dotnet-apphost-pack-3.1 |
| ||
| dotnet-apphost-pack-5.0 |
| ||
| dotnet-hostfxr-3.1 |
| ||
| dotnet-hostfxr-5.0 |
| ||
| dotnet-runtime-3.1 |
| ||
| dotnet-runtime-5.0 |
| ||
| dotnet-sdk-3.1 |
| ||
| dotnet-sdk-3.1-source-built-artifacts |
| ||
| dotnet-sdk-5.0 |
| ||
| dotnet-sdk-5.0-source-built-artifacts |
| ||
| dotnet-targeting-pack-3.1 |
| ||
| dotnet-targeting-pack-5.0 |
| ||
| dotnet-templates-3.1 |
| ||
| dotnet-templates-5.0 |
| ||
| python3-brotli |
|
Common Weakness Enumeration
- CWE-130 - Improper Handling of Length Parameter InconsistencyThe software parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
References