Skip to content

CVE-2020-8927 (Medium) detected in src73.0.3677.0 #45

Open
@mend-bolt-for-github

Description

@mend-bolt-for-github

CVE-2020-8927 - Medium Severity Vulnerability

Vulnerable Library - src73.0.3677.0

Library home page: https://chromium.googlesource.com/chromium/src

Found in HEAD commit: 00fdb00d5bdbaea4fec4642989374d82cbdb1a3c

Found in base branch: master

Vulnerable Source Files (13)

/deps/brotli/c/enc/command.h
/deps/brotli/c/dec/bit_reader.h
/deps/brotli/c/dec/bit_reader.c
/deps/brotli/c/enc/brotli_bit_stream.c
/deps/brotli/c/common/platform.h
/deps/brotli/c/enc/entropy_encode.c
/deps/brotli/c/dec/prefix.h
/deps/brotli/c/dec/state.c
/deps/brotli/c/enc/entropy_encode.c
/deps/brotli/c/common/context.h
/deps/brotli/c/dec/bit_reader.c
/deps/brotli/c/common/context.h
/deps/brotli/c/dec/bit_reader.h

Vulnerability Details

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

Publish Date: 2020-09-15

URL: CVE-2020-8927

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-09-15

Fix Resolution: 1.0.8


Step up your Open Source Security Game with Mend here

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions