Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Since I checked Rust servers should be fine since the brotli crate is not a binding on the C.
    by Sytten
  • Interestingly the commit that fixes this in brotli dates back to February https://github.com/google/brotli/commit/0ed4268a4401abcb4472...
    by adzm
  • There’s apparently no writeup on exactly what was the fix. So I’m going to make a guess that this is the chromium commit that fixed the problem: https://source.chromium.org/chromium/chromium/src/+/224140d4...

    And this commit contained a refactoring from BROTLI_BOOL to BrotliDecoderErrorCode so the situation was that probably one of the error conditions previously simply returned false but needed more detail about what went wrong to continue safely.

    Well okay this change from `if (prev_ix < cur_ix)` to `if (prev_ix < cur_ix && cached_backward <= max_backward)` is also suspicious and could be an related or unrelated hardening fix.

    by kccqzy
  • It looks like brotli <= 1.2.0 is vulnerable.

    The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/

    by rvanlaar
  • I feel like normal security issues don't get much publicity. The PHP and eMudhra issues seemed severe, and worth publicity. But then with things like this, I'm not sure. Is this a severe issue? Or is it just a run of the mill issue that's only newsworthy because web security is on people's minds right now?
    by hatthew
  • I could do without every memory bug getting a cute sensational name and marketing push, I have to say.
    by anonymous908213
  • This one again feels overblown, at least for servers. I just checked an org of over 200 GitHub repos. Node, Python, and C#. None of them are vulnerable... because none of them actually call the Brotli decoder. It's just not enabled by default on the server side, by the platforms themselves. This is much like the PHP bugs, where specific conditions have to be in play before you're actually vulnerable.

    For clients? Sure, that's a bigger risk. Patch them. But bad guys aren't attacking your clients unless the clients connect to them. Don't stay up late to fix this.

    (And yes, .NET is included here, because Microsoft's Brotli module is a binding for Google's vulnerable reference implementation.)

    by ataraxia937
  • Someone already created this website, for some reason,

    https://broccoli2shell.com/

    by ks2048

Explore Birbla archives