Buffer Overflow Vulnerability in Brotli Library
Summary
CVE-2020-36846: A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over... Affects brotli across 4 version ranges.
< 1.0.9-r0
< 8b41c63650f1c1223ce82de5d9040c1f7ff470c1
>= b54b188c1804d4dcebb09a8be3a67916abd94fd7, < 3269c95a72af9a3a161884dbae99eae0352b3e7d
< e61745a6b7add50d380cfd7d3883dd6c62fc2c71
Fixed in 1.0.9-r0. How to fix ↓
Also tracked for
- powershell · Bitnami
- github.com/google/brotli · Go
- dotnet-sdk · Bitnami
- dotnet · Bitnami
- brotli · Bitnami
- brotli-sys · crates.io
- compu-brotli-sys · crates.io
- brotli · PyPI
The same CVE-2020-36846 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Brotli library is a compression library developed by Google that provides efficient and fast compression and decompression algorithms. It is widely used in various applications and frameworks. However, versions prior to 1.0.8 are vulnerable to a buffer overflow issue.
Vulnerability Detail
The buffer overflow vulnerability (CVE-2020-8927) in the Brotli library allows an attacker to trigger a crash by controlling the input length of a "one-shot" decompression request. This crash occurs when copying over chunks of data larger than 2 GiB. The vulnerability can be exploited to execute arbitrary code or cause denial of service. It is recommended to update the Brotli library to version 1.0.8 or later. If updating is not possible, using the "streaming" API and imposing chunk size limits is recommended.
How To Fix
Minimum fixed version
1.0.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade brotliTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the Brotli library is not feasible, a workaround is to use the "streaming" API instead of the "one-shot" API. By imposing chunk size limits, the risk of triggering the buffer overflow can be mitigated. Here is an example of using the "streaming" API in Python:
import brotli
def decompress_data(data):
decompressor = brotli.Decompressor()
chunk_size = 1024
offset = 0
while offset < len(data):
chunk = data[offset:offset+chunk_size]
decompressed_chunk = decompressor.process(chunk)
offset += chunk_size
# Process the decompressed chunk
decompressed_data = decompressor.finish()
# Process the final decompressed data
Conclusion
The buffer overflow vulnerability in the Brotli library (CVE-2020-8927) can be mitigated by updating to version 1.0.8 or later. If updating is not possible, using the "streaming" API with chunk size limits is recommended. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for brotli →
FAQ
The vulnerability can be exploited by an attacker to crash the application, execute arbitrary code, or cause denial of service.
Versions prior to 1.0.8 are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time.
Yes, updating the Brotli library to version 1.0.8 or later will fix the vulnerability. Alternatively, using the "streaming" API and imposing chunk size limits can mitigate the risk.
You can find more information about this vulnerability in the CVE-2020-8927 JSON report available at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8927.json
Related vulnerabilities
Recent vulnerabilities recorded for brotli.
