Threat Investigation
Təqdimat tələb edin

CVE-2020-36846

Kritik

Təsvir

CVE-2020-8927-də təsvir edildiyi kimi, daxili Brotli kitabxanasında bufer daşması mövcuddur. IO::Compress::Brotli-nin 0.007 versiyasından əvvəlki versiyaları, brotli kitabxanasının 1.0.8 versiyasından əvvəlki versiyasını ehtiva edirdi və burada skriptə göndərilən "one-shot" sıxılmamış sorğunun giriş uzunluğunu idarə edən hücumçu, 2 GiB-dən böyük məlumat bloklarının kopyalanması zamanı sistemin çökməsinə səbəb ola bilər. IO::Compress::Brotli modulunuzu 0.007 və ya daha yeni versiyaya yeniləmək tövsiyə olunur. Yeniləmə mümkün deyilsə, "one-shot" API əvəzinə "streaming" API istifadə etmək və blok ölçüsü limitləri tətbiq etmək tövsiyə edilir.

CiddilikKritik
CVSS9.8
İstismar ehtimalı—
MəhsulBrotli
Dərc30 may 2025
İlk görülmə30 may 2025
Zəiflik növüCWE-1395CWE-1395

Necə düzəltmək olar

Yeniləyin
  • brotli1.0.8 və ya daha yeni versiya
  • compu-brotli-sys1.0.9 və ya daha yeni versiya
  • Microsoft.NETCore.App.Runtime.linux-arm3.1.23, 5.0.15, 6.0.3 və ya daha yeni versiya
  • Microsoft.NETCore.App.Runtime.linux-arm643.1.23, 5.0.15, 6.0.3 və ya daha yeni versiya
  • Microsoft.NETCore.App.Runtime.linux-musl-arm643.1.23, 5.0.15, 6.0.3 və ya daha yeni versiya
  • Microsoft.NETCore.App.Runtime.linux-x643.1.23, 5.0.15, 6.0.3 və ya daha yeni versiya
  • Microsoft.NETCore.App.Runtime.osx-x643.1.23, 5.0.15, 6.0.3 və ya daha yeni versiya
  • Microsoft.NETCore.App.Runtime.win-arm3.1.23, 5.0.15, 6.0.3 və ya daha yeni versiya
  • Microsoft.NETCore.App.Runtime.win-arm643.1.23, 5.0.15, 6.0.3 və ya daha yeni versiya
  • Microsoft.NETCore.App.Runtime.win-x643.1.23, 5.0.15, 6.0.3 və ya daha yeni versiya
  • Microsoft.NETCore.App.Runtime.win-x863.1.23, 5.0.15, 6.0.3 və ya daha yeni versiya
  • Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm645.0.15, 6.0.3 və ya daha yeni versiya
Yamaqlar
İstehsalçı bildirişləri

Təsirlənən məhsullar

MəhsulTəsirlənən versiyalarDüzəldildiyi versiya
brotliPyPIv < 1.0.81.0.8
compu-brotli-syscrates.iov < 1.0.91.0.9
Microsoft.NETCore.App.Runtime.linux-armNuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-arm64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-x64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.osx-x64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-armNuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-arm64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-x64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-x86NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-armNuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-arm64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.osx-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.browser-wasmNuGet5.0.0 ≤ v < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.linux-musl-armNuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.browser-wasmNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.browser-wasmNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvos-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasmNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasmNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.osx-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.win-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.win-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.osx-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
github.com/google/brotliGoAralıq göstərilməyib—

Versiyanızı yoxlayın

Məhsulu seçin və istifadə etdiyiniz versiyanı yazın; versiyanın təsirlənən aralıqda olub-olmadığını görün.

Intelligence 360 paketində

Attack Surface Management

Domenlərinizə bağlı aktivləri, onlarda işləyən texnologiyaları və məlum zəiflikləri bir siyahıda görün.