CVE-2020-8927: Integer overflow in the bundled Brotli C library
(updated )
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a “one-shot” decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the “streaming” API as opposed to the “one-shot” API, and impose chunk size limits.
References
- github.com/advisories/GHSA-5v8v-66v8-mwm7
- github.com/bitemyapp/brotli2-rs
- github.com/bitemyapp/brotli2-rs/issues/45
- github.com/github/advisory-database/issues/785
- github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6
- github.com/google/brotli/releases/tag/v1.0.8
- github.com/google/brotli/releases/tag/v1.0.9
- github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2020-29.yaml
- lists.debian.org/debian-lts-announce/2020/12/msg00003.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG
- nvd.nist.gov/vuln/detail/CVE-2020-8927
- rustsec.org/advisories/RUSTSEC-2021-0131.html
- rustsec.org/advisories/RUSTSEC-2021-0132.html
- usn.ubuntu.com/4568-1
- www.debian.org/security/2020/dsa-4801
Code Behaviors & Features
Detect and mitigate CVE-2020-8927 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →