Description
CVE-2020-8927 - Medium Severity Vulnerability
Vulnerable Library - src73.0.3677.0
Library home page: https://chromium.googlesource.com/chromium/src
Found in HEAD commit: 00fdb00d5bdbaea4fec4642989374d82cbdb1a3c
Found in base branch: master
Vulnerable Source Files (13)
/deps/brotli/c/enc/command.h
/deps/brotli/c/dec/bit_reader.h
/deps/brotli/c/dec/bit_reader.c
/deps/brotli/c/enc/brotli_bit_stream.c
/deps/brotli/c/common/platform.h
/deps/brotli/c/enc/entropy_encode.c
/deps/brotli/c/dec/prefix.h
/deps/brotli/c/dec/state.c
/deps/brotli/c/enc/entropy_encode.c
/deps/brotli/c/common/context.h
/deps/brotli/c/dec/bit_reader.c
/deps/brotli/c/common/context.h
/deps/brotli/c/dec/bit_reader.h
Vulnerability Details
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
Publish Date: 2020-09-15
URL: CVE-2020-8927
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
Step up your Open Source Security Game with Mend here