CVE-2020-36846: IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library
A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36846?
CVE-2020-36846 is classified as a high severity vulnerability due to the potential for remote code execution via a buffer overflow.
How do I fix CVE-2020-36846?
To mitigate CVE-2020-36846, upgrade IO::Compress::Brotli to version 0.007 or higher, and ensure the Brotli library is at version 1.0.8 or above.
What products are affected by CVE-2020-36846?
CVE-2020-36846 affects Perl IO::Compress::Brotli versions prior to 0.007 and the Brotli library versions prior to 1.0.8.
What kind of attack does CVE-2020-36846 allow?
CVE-2020-36846 enables attackers to control the input length of a decompression request, potentially leading to a buffer overflow.
Is there a way to test for CVE-2020-36846?
Testing for CVE-2020-36846 typically involves reviewing application dependencies for vulnerable versions of IO::Compress::Brotli and the Brotli library.