Improper Handling of Length Parameter Inconsistency The advisory has been revoked - it doesn't affect any version of package dotnet5.0 (opens in a new tab)

Threat Intelligence

3.22% (87^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-CENTOS8-DOTNET50-2420105
published26 Jul 2021
disclosed27 Aug 2020

Report a new vulnerability Found a mistake?

Introduced: 27 Aug 2020

CVE-2020-8927 (opens in a new tab) CWE-130 (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream dotnet5.0 package and not the dotnet5.0 package as distributed by Centos.

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.