@LeelaTorres
(S) OpenAl &

@​OpenAl
During this red-teaming exercise, we also found a vulnerability that
allows for unauthenticated remote code execution in Brotli, a widely-

deployed compression library included in many pieces of software such
as Node,js, Bun, and Envoy.

The flaw could let an attacker run their own code on affected systems by
sending or replying with malicious compressed data, without any need to
create a user account. That is, an unpatched server that accepts
compressed input could be taken over by a malicious client, and an
unpatched client that accepts compressed input (such as “curl -—-
compressed”) could be taken over by a malicious server.

This root cause issue was actually fixed in the Brotli source code in
February, but it wasn’t known at the time that it gave rise to a security
vulnerability and there was no more recent release of Brotli. Since Brotli
is built into other software, any software which includes this library
needs to take the update too, followed by the users of that software. We
disclosed the vulnerability to Brotli and other downstream projects such
as Node,js, which released or are currently releasing security updates,
and Brotli cut new release versions and published a CVE.