Greg Brockman 披露 Brotli 压缩库中的未认证远程代码执行漏洞
we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library. it's both an impactful issue and...
AI 导读
Greg Brockman 披露其在红队演练中发现 Brotli 压缩库存在未认证远程代码执行漏洞，相关披露工作已进行一段时间。Brotli 被集成到 Node.js、Bun、Envoy 等大量下游软件中，作者以此说明协调打补丁的复杂程度。