Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2020-8927

Опубликовано: 27 авг. 2020
Источник: redhat
CVSS3: 6.5
EPSS Низкий

Описание

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

A buffer overflow flaw was found in the Brotli library where an attacker could control the input length of a "one-shot" decompression request to a script that can trigger a crash. This issue can happen when copying chunks of data larger than 2 GiB.

Меры по смягчению последствий

This flaw can be mitigated by using Streaming API instead of the One-Shot API and imposing chunk size limitations.

Дополнительная информация

Статус:

Important
Дефект:
CWE-130
https://bugzilla.redhat.com/show_bug.cgi?id=1879225brotli: buffer overflow when input chunk is larger than 2GiB

EPSS

Процентиль: 60%
0.00399
Низкий

6.5 Medium

CVSS3

Связанные уязвимости

CVSS3: 5.3
ubuntu
почти 5 лет назад

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

CVSS3: 5.3
nvd
почти 5 лет назад

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

CVSS3: 6.5
msrc
больше 3 лет назад

Brotli Library Buffer Overflow Vulnerability

CVSS3: 5.3
debian
почти 5 лет назад

A buffer overflow exists in the Brotli library versions prior to 1.0.8 ...

suse-cvrf
больше 3 лет назад

Security update for brotli

EPSS

Процентиль: 60%
0.00399
Низкий

6.5 Medium

CVSS3