Reported

December 20, 2021

Issued

December 21, 2021 (last modified: June 13, 2023)

Package

compu-brotli-sys (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Keywords

#integer-overflow

Aliases

• CVE-2020-8927
• GHSA-5v8v-66v8-mwm7

References

• https://github.com/google/brotli/releases/tag/v1.0.9

Patched

• >=1.0.9

Description

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB.

If one cannot update the C library, its authors recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

Advisory available under CC0-1.0 license.