Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2020-8927— Buffer overflow in Brotli library

Quick assessment

Affected
Google LLC Brotli
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Google brotli Library是美国谷歌（Google）公司的一种数据压缩算法的扩展库使用 LZ77 算法、赫夫曼编码和二阶上下文建模的现代变体组合来压缩数据，其压缩比可与目前可用的最佳通用压缩方法相媲美。 Google brotli Library 1.0.8之前版本存在缓冲区错误漏洞，攻击者控制脚本的一次性解压缩请求的输入长度可能会触发崩溃。

CVSS 5.3 · Medium EPSS 3.22% · P88

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Google LLC Brotli stable≤ 1.0.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-8927

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Buffer overflow in Brotli library
Source: CVE Program / CVE List V5
Vulnerability Description
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
长度参数不一致性处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Google brotli Library 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Google brotli Library是美国谷歌（Google）公司的一种数据压缩算法的扩展库使用 LZ77 算法、赫夫曼编码和二阶上下文建模的现代变体组合来压缩数据，其压缩比可与目前可用的最佳通用压缩方法相媲美。 Google brotli Library 1.0.8之前版本存在缓冲区错误漏洞，攻击者控制脚本的一次性解压缩请求的输入长度可能会触发崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Google LLC Brotli stable ~ 1.0.7 -

II. Public POCs for CVE-2020-8927

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-8927

请登录查看更多情报信息。

Vendor Advisories for CVE-2020-8927 (2)

Mailing List Discussions for CVE-2020-8927 (10)

Other References for CVE-2020-8927 (1)

IV. Related Vulnerabilities

Same vendor: Google LLC
Same weakness: CWE-130

V. Comments for CVE-2020-8927

No comments yet

Leave a comment