GHSA-9v8h-qqgm-4m35
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
- brotli (PyPI)
- Critical
- CVSS 9.2
- Fixed version listed
What to do
Fixed version listed
Affected packages
| Package | Affected | Fixed in | Advisory |
|---|---|---|---|
| brotli (PyPI) | >= 1.0.3, < 1.2.1 | 1.2.1 | GHSA-9v8h-qqgm-4m35 |
| brotlicffi (PyPI) | >= 1.0.3, < 1.2.1.0 | 1.2.1.0 | GHSA-9v8h-qqgm-4m35 |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.2 (v4.0, scored by GitHub)
Timeline
- GitHub published advisory GHSA-9v8h-qqgm-4m35 (critical). Fixed in 1.2.1, 1.2.1.0.