Is CVE-2020-8927 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 3%.

What products does CVE-2020-8927 affect?

Tracked products affected include .NET. Check the version you run to see whether it is affected.

How do I fix CVE-2020-8927?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

CVE-2020-8927

Q: What is CVE-2020-8927?

CVE-2020-8927 is a medium-severity software vulnerability (CWE-130) with a CVSS score of 5.3. A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larg

MEDIUM severity · CVSS 5.3 · CWE-130

5.3CVSS MEDIUM

Summary

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactNone

Integrity impactLow

Availability impactNone

Exploit probability (EPSS)3%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products we track (1)

.NET

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00108.htmlAdvisory
https://github.com/google/brotli/releases/tag/v1.0.9Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00003.htmlAdvisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP/