Buffer overflow in brotli - CVE-2020-8927

Vulnerability identifier: #VU46905

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8927

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

brotli
Arch Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
Fedora
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat CodeReady Linux Builder for x86_64
Public Cloud Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
Server Applications Module
Python 3 Module
Opensuse
openSUSE Leap
Ubuntu
openEuler
rh-dotnet31-dotnet (Red Hat package)
rh-dotnet50-dotnet (Red Hat package)
dotnet5.0 (Red Hat package)
brotli (Alpine package)
samba (Alpine package)
python-brotli (Ubuntu package)
python3-brotli (Ubuntu package)
brotli (Ubuntu package)
brotli (Debian package)
libbrotli1 (Ubuntu package)
python3-brotlipy
python3-brotlipy-debuginfo
python-brotlipy
python-brotlipy-debuginfo
python-brotlipy-debugsource
golang-github-andybalholm-brotli
brotli (Red Hat package)
libbrotlicommon1-debuginfo
libbrotlienc1-debuginfo
libbrotlidec1-debuginfo
brotli-debugsource
libbrotlidec1
brotli-debuginfo
libbrotlicommon1
libbrotli-devel
libbrotlienc1
python2-brotli
python3-brotli
brotli-help
brotli-devel
brotli
python-Brotli-debugsource
python3-Brotli
python3-Brotli-debuginfo
python-Brotli-debuginfo
dotnet-targeting-pack-3.1
dotnet-runtime-3.1
dotnet-hostfxr-3.1
dotnet-apphost-pack-3.1
aspnetcore-targeting-pack-3.1
aspnetcore-runtime-3.1
dotnet3.1 (Red Hat package)
dotnet3.1
dotnet-templates-3.1
dotnet-sdk-3.1
dotnet-sdk-3.1-source-built-artifacts
aspnetcore-runtime-5.0
aspnetcore-targeting-pack-5.0
dotnet-apphost-pack-5.0
dotnet-hostfxr-5.0
dotnet-runtime-5.0
dotnet-targeting-pack-5.0
dotnet-sdk-5.0
dotnet-templates-5.0
Red Hat OpenShift Serverless
Windows Container Support for Red Hat OpenShift
OpenShift Virtualization
Service Telemetry Framework
IBM Robotic Process Automation
Cloud Pak for Security (CP4S)
Red Hat OpenShift Jaeger
Microsoft .NET Core
RoboHelp
Visual Studio
IBM Security Verify Access
Web Terminal

Install update from vendor's website.

brotli - update to 1.0.8
rh-dotnet31-dotnet (Red Hat package) - update to 3.1.417-1.el7_9
rh-dotnet50-dotnet (Red Hat package) - update to 5.0.212-1.el7_9
dotnet5.0 (Red Hat package) - update to 5.0.212-1.el8_5
Red Hat OpenShift Serverless - update to 1.16.0
Cloud Pak for Security (CP4S) - update to 1.8.0.0
Red Hat OpenShift Jaeger - addressed in versions 1.17.9, 1.20.4
Windows Container Support for Red Hat OpenShift - update to 2.0.1
IBM Robotic Process Automation - update to 21.0.2.3
samba (Alpine package) - update to 4.12.7-r0
python-brotli (Ubuntu package) - addressed in versions 1.0.3-1ubuntu1~16.04.2, 1.0.3-1ubuntu1.3
python3-brotli (Ubuntu package) - addressed in versions 1.0.3-1ubuntu1~16.04.2, 1.0.3-1ubuntu1.3, 1.0.7-6ubuntu0.1
brotli (Ubuntu package) - addressed in versions 1.0.3-1ubuntu1~16.04.2, 1.0.3-1ubuntu1.3, 1.0.7-6ubuntu0.1
brotli (Debian package) - update to 1.0.7-2+deb10u1
libbrotli1 (Ubuntu package) - addressed in versions 1.0.3-1ubuntu1~16.04.2, 1.0.3-1ubuntu1.3, 1.0.7-6ubuntu0.1
python3-brotlipy - addressed in versions 0.6.0-2.6.1, 0.7.0-150100.3.6.1, 0.7.0-150300.3.3.1
python3-brotlipy-debuginfo - addressed in versions 0.6.0-2.6.1, 0.7.0-150100.3.6.1, 0.7.0-150300.3.3.1
python-brotlipy - update to 0.6.0-2.6.1
python-brotlipy-debuginfo - addressed in versions 0.6.0-2.6.1, 0.7.0-150100.3.6.1, 0.7.0-150300.3.3.1
python-brotlipy-debugsource - addressed in versions 0.6.0-2.6.1, 0.7.0-150100.3.6.1, 0.7.0-150300.3.3.1
golang-github-andybalholm-brotli - addressed in versions 1.0.1-1.fc31, 1.0.1-1.fc32, 1.0.1-1.fc33
brotli (Red Hat package) - update to 1.0.6-3.el8
libbrotlicommon1-debuginfo - update to 1.0.7-3.3.1
libbrotlienc1-debuginfo - update to 1.0.7-3.3.1
libbrotlidec1-debuginfo - update to 1.0.7-3.3.1
brotli-debugsource - update to 1.0.7-3.3.1
libbrotlidec1 - update to 1.0.7-3.3.1
brotli-debuginfo - update to 1.0.7-3.3.1
libbrotlicommon1 - update to 1.0.7-3.3.1
libbrotli-devel - update to 1.0.7-3.3.1
libbrotlienc1 - update to 1.0.7-3.3.1
brotli-debuginfo - update to 1.0.7-4
python2-brotli - update to 1.0.7-4
python3-brotli - update to 1.0.7-4
brotli-debugsource - update to 1.0.7-4
brotli-help - update to 1.0.7-4
brotli-devel - update to 1.0.7-4
brotli - update to 1.0.7-4
python-Brotli-debugsource - update to 1.0.7-150200.3.3.1
python3-Brotli - update to 1.0.7-150200.3.3.1
python3-Brotli-debuginfo - update to 1.0.7-150200.3.3.1
python-Brotli-debuginfo - update to 1.0.7-150200.3.3.1
brotli - addressed in versions 1.0.9-3.fc31, 1.0.9-3.fc32, 1.0.9-3.fc33, 1.0.9-10.el7
dotnet-targeting-pack-3.1 - update to 3.1.23-1.0.1
dotnet-runtime-3.1 - update to 3.1.23-1.0.1
dotnet-hostfxr-3.1 - update to 3.1.23-1.0.1
dotnet-apphost-pack-3.1 - update to 3.1.23-1.0.1
aspnetcore-targeting-pack-3.1 - update to 3.1.23-1.0.1
aspnetcore-runtime-3.1 - update to 3.1.23-1.0.1
dotnet3.1 (Red Hat package) - update to 3.1.417-1.el8_5
dotnet3.1 - addressed in versions 3.1.417-1.fc34, 3.1.417-1.fc35, 3.1.417-1.fc36
dotnet-templates-3.1 - update to 3.1.417-1.0.1
dotnet-sdk-3.1 - update to 3.1.417-1.0.1
dotnet-sdk-3.1-source-built-artifacts - update to 3.1.417-1.0.1
aspnetcore-runtime-5.0 - update to 5.0.15-1.0.1
aspnetcore-targeting-pack-5.0 - update to 5.0.15-1.0.1
dotnet-apphost-pack-5.0 - update to 5.0.15-1.0.1
dotnet-hostfxr-5.0 - update to 5.0.15-1.0.1
dotnet-runtime-5.0 - update to 5.0.15-1.0.1
dotnet-targeting-pack-5.0 - update to 5.0.15-1.0.1
dotnet-sdk-5.0 - update to 5.0.212-1.0.1
dotnet-templates-5.0 - update to 5.0.212-1.0.1
Web Terminal - update to 1.3
OpenShift Virtualization - addressed in versions 2.6.6, 4.8.0

• https://github.com/google/brotli/releases/tag/v1.0.9

• Buffer overflow in Google brotli
• Arch Linux update for lib32-brotli
• Arch Linux update for brotli
• OpenSUSE Linux update for brotli
• Buffer overflow in brotli (Alpine package)
• Debian update for brotli
• Red Hat Enterprise Linux 8 update for brotli
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in Windows Container Support for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in Red Hat Web Terminal
• Multiple vulnerabilities in IBM Security Verify Access
• Buffer overflow in Microsoft .NET and Visual Studio
• Red Hat Enterprise Linux 8 update for .NET Core 3.1
• Red Hat Enterprise Linux 7 update for .NET 5.0
• Red Hat Enterprise Linux 7 update for .NET Core 3.1
• Red Hat Enterprise Linux 8 update for .NET 5.0
• SUSE update for brotli
• Multiple vulnerabilities in Red Hat Service Telemetry Framework
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• SUSE update for python-brotlipy
• SUSE update for python-brotlipy
• SUSE update for python-brotlipy
• openEuler 20.03 LTS update for brotli
• SUSE update for python-Brotli
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 2.6
• Fedora 36 update for dotnet3.1
• Fedora 35 update for dotnet3.1
• Fedora 34 update for dotnet3.1
• Fedora EPEL 7 update for brotli
• Anolis OS update for dotnet3.1
• Anolis OS update for dotnet5.0
• Ubuntu update for brotli
• Fedora 33 update for golang-github-andybalholm-brotli
• Fedora 32 update for golang-github-andybalholm-brotli
• Fedora 31 update for golang-github-andybalholm-brotli
• Fedora 32 update for brotli
• Fedora 33 update for brotli
• Fedora 31 update for brotli
• SUSE update for brotli