Packaged version of brotli is affected by CVE-2020-8927

bitemyapp / brotli2-rs

Brotli encoders/decoers for Rust

Apache License 2.0

28 stars 13 forks source link

Open insanitybit opened 2 years ago

insanitybit commented 2 years ago

Brotli versions prior 1.0.8 are affected by CVE-2020-8927.

This is an integer overflow and I believe it is reachable from the rust bindings, but that's just based on a quick perusal of the source code.

I'm currently working on a PR to add an advisory to the rustsec adivsorydb as well.

ruuda commented 2 years ago

A simple solution is to not vendor Brotli, but to link against a system-provided libbrotli instead, which can be kept up to date independently, and requires no code changes in the Rust code to update. For an example, see https://github.com/ruuda/brotli2-rs/commit/ec1c87ed98b25c30b24c97ebf376d067233acfe4.

DoumanAsh commented 7 months ago