CVE-2020-36846

Kritik

Açıklama

CVE-2020-8927'de açıklandığı üzere, gömülü Brotli kütüphanesinde bir arabellek taşması mevcuttur. IO::Compress::Brotli'nin 0.007 öncesindeki sürümleri, brotli kütüphanesinin 1.0.8 öncesindeki bir sürümünü içermekteydi; burada bir betiğe yapılan "one-shot" sıkıştırmayı açma isteğinin giriş uzunluğunu kontrol eden bir saldırgan, 2 GiB'den büyük veri blokaları kopyalanırken meydana gelen ve sistem çökmesine yol açan bir durumu tetikleyebilir. IO::Compress::Brotli modülünüzü 0.007 veya daha yeni bir sürüme güncellemeniz önerilir. Güncelleme yapılamıyorsa, "one-shot" API yerine "streaming" API kullanılması ve blok boyutu sınırlarının getirilmesi tavsiye edilir.

ÖnemKritik
CVSS9.8
İstismar olasılığı—
ÜrünBrotli
Yayın30 May 2025
İlk görülme30 May 2025
Zayıflık türüCWE-1395CWE-1395

Nasıl düzeltilir

Güncelleyin
  • brotli1.0.8 ya da sonraki bir sürüm
  • compu-brotli-sys1.0.9 ya da sonraki bir sürüm
  • Microsoft.NETCore.App.Runtime.linux-arm3.1.23, 5.0.15, 6.0.3 ya da sonraki bir sürüm
  • Microsoft.NETCore.App.Runtime.linux-arm643.1.23, 5.0.15, 6.0.3 ya da sonraki bir sürüm
  • Microsoft.NETCore.App.Runtime.linux-musl-arm643.1.23, 5.0.15, 6.0.3 ya da sonraki bir sürüm
  • Microsoft.NETCore.App.Runtime.linux-x643.1.23, 5.0.15, 6.0.3 ya da sonraki bir sürüm
  • Microsoft.NETCore.App.Runtime.osx-x643.1.23, 5.0.15, 6.0.3 ya da sonraki bir sürüm
  • Microsoft.NETCore.App.Runtime.win-arm3.1.23, 5.0.15, 6.0.3 ya da sonraki bir sürüm
  • Microsoft.NETCore.App.Runtime.win-arm643.1.23, 5.0.15, 6.0.3 ya da sonraki bir sürüm
  • Microsoft.NETCore.App.Runtime.win-x643.1.23, 5.0.15, 6.0.3 ya da sonraki bir sürüm
  • Microsoft.NETCore.App.Runtime.win-x863.1.23, 5.0.15, 6.0.3 ya da sonraki bir sürüm
  • Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm645.0.15, 6.0.3 ya da sonraki bir sürüm

Etkilenen ürünler

ÜrünEtkilenen sürümlerDüzeltildiği sürüm
brotliPyPIv < 1.0.81.0.8
compu-brotli-syscrates.iov < 1.0.91.0.9
Microsoft.NETCore.App.Runtime.linux-armNuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-arm64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-x64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.osx-x64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-armNuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-arm64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-x64NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.win-x86NuGet3.0.0 ≤ v < 3.1.23, 5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.33.1.23, 5.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-armNuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-arm64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.Mono.osx-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.browser-wasmNuGet5.0.0 ≤ v < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.linux-musl-armNuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet5.0.0 ≤ v < 5.0.15, 6.0.0 ≤ v < 6.0.35.0.15, 6.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.browser-wasmNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.browser-wasmNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvos-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasmNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasmNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-armNuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.osx-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.win-x64NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.win-x86NuGet6.0.0 ≤ v < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.osx-arm64NuGet6.0.0 ≤ v < 6.0.36.0.3
github.com/google/brotliGoAralık belirtilmemiş—

Sürümünüzü kontrol edin

Ürünü seçin ve kullandığınız sürümü yazın; sürümün etkilenen aralıkta olup olmadığını görün.

Intelligence 360 paketinde

Attack Surface Management

Alan adlarınıza bağlı varlıkları, bu varlıklarda çalışan teknolojileri ve bilinen zafiyetleri tek listede görün.

CVE-2020-36846 · Brotli · Dark Radar