Miggo Logo

CVE-2020-8927: Integer overflow in the bundled Brotli C library

6.5

CVSS Score
3.1

Basic Information

EPSS Score
0.5913%
Published
5/24/2022
Updated
9/16/2024
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
compu-brotli-sysrust< 1.0.91.0.9
Microsoft.NETCore.App.Runtime.linux-armnuget>= 3.0.0, < 3.1.233.1.23
Microsoft.NETCore.App.Runtime.linux-arm64nuget>= 3.0.0, < 3.1.233.1.23
Microsoft.NETCore.App.Runtime.linux-musl-arm64nuget>= 3.0.0, < 3.1.233.1.23
Microsoft.NETCore.App.Runtime.linux-x64nuget>= 3.0.0, < 3.1.233.1.23
Microsoft.NETCore.App.Runtime.osx-x64nuget>= 3.0.0, < 3.1.233.1.23
Microsoft.NETCore.App.Runtime.win-armnuget>= 3.0.0, < 3.1.233.1.23
Microsoft.NETCore.App.Runtime.win-arm64nuget>= 3.0.0, < 3.1.233.1.23
Microsoft.NETCore.App.Runtime.win-x64nuget>= 3.0.0, < 3.1.233.1.23
Microsoft.NETCore.App.Runtime.win-x86nuget>= 3.0.0, < 3.1.233.1.23
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.Mono.linux-armnuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.Mono.linux-arm64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.Mono.linux-x64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.Mono.osx-x64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.browser-wasmnuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.linux-armnuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.linux-arm64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.linux-musl-armnuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.linux-musl-arm64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.linux-musl-x64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.linux-x64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.osx-x64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.win-armnuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.win-arm64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.win-x64nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.win-x86nuget>= 5.0.0, < 5.0.155.0.15
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-armnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.browser-wasmnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-armnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.browser-wasmnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-armnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvos-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-armnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasmnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-armnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasmnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-armnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-armnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.linux-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.osx-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.osx-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.win-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.Mono.win-x86nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.linux-armnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.linux-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.linux-musl-armnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.linux-musl-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.linux-musl-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.linux-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.osx-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.osx-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.win-armnuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.win-arm64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.win-x64nuget>= 6.0.0, < 6.0.36.0.3
Microsoft.NETCore.App.Runtime.win-x86nuget>= 6.0.0, < 6.0.36.0.3
brotlipip>= 0, < 1.0.81.0.8

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability (CVE-2020-8927) explicitly affects Brotli's 'one-shot' decompression API when handling inputs >2 GiB. The advisory and commit messages indicate the root cause was improper integer overflow checks during buffer operations. The primary entry points for one-shot decompression are 'BrotliDecoderDecompress' and its streaming counterpart 'BrotliDecoderDecompressStream', both in decode.c. The fixed commit (223d80c) specifically addresses overflow in the decoder, confirming these functions' involvement. The Rust/Python packages wrap this C library, inheriting the vulnerability. High confidence stems from the explicit linkage between the vulnerability description, API usage guidance (avoiding one-shot), and Brotli's code structure.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *u***r ov*r*low *xists in t** *rotli li*r*ry v*rsions prior to *.*.* w**r* *n *tt**k*r *ontrollin* t** input l*n*t* o* * "on*-s*ot" ***ompr*ssion r*qu*st to * s*ript **n tri***r * *r*s*, w*i** **pp*ns w**n *opyin* ov*r **unks o* **t* l*r**r t**n *

Reasoning

T** vuln*r**ility (*V*-****-****) *xpli*itly *****ts *rotli's 'on*-s*ot' ***ompr*ssion *PI w**n **n*lin* inputs >* *i*. T** **visory *n* *ommit m*ss***s in*i**t* t** root **us* w*s improp*r int***r ov*r*low ****ks *urin* *u***r op*r*tions. T** prim*r