Evolving Threat: http2shell is an RCE in node, Python, and more

(nitter.click)

49 points | by cowlevel 1 hour ago

10 comments

anonymous908213 9 minutes ago
I could do without every memory bug getting a cute sensational name and marketing push, I have to say.
rvanlaar 40 minutes ago
It looks like brotli <= 1.2.0 is vulnerable.
The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/
adzm 58 minutes ago
Interestingly the commit that fixes this in brotli dates back to February https://github.com/google/brotli/commit/0ed4268a4401abcb4472...
[-]
- cowlevel 13 minutes ago
  OpenAI's tweet says it wasn't recognized as security relevant so wasn't important enough to make a release - until their agent realised it was.
  https://nitter.jaydenha.uk/OpenAI/status/2113766354386084338
Sytten 49 minutes ago
Since I checked Rust servers should be fine since the brotli crate is not a binding on the C.
cowlevel 1 hour ago
Likely mitigation: disable brotli (br) content-encoding on both sides
profdevloper 1 hour ago
https://x.com/AikidoSecurity/status/2113759110625906950
[-]
QuadmasterXLII 34 minutes ago
is flask hello world with gunicorn behind apache vulnerable?
[-]
- TZubiri 24 minutes ago
  what I can say is that a 5 liner hello world starting with ‘import socket’ is not affected
  whether a hello wolrd in fastapi is affected might also be interesting
DogeGode 27 minutes ago
Another day, another buffer-overflow vulnerability in C code …
[-]
- cowlevel 12 minutes ago
  [flagged]
bibekadhikari 18 minutes ago
[flagged]
bogomind 41 minutes ago
[flagged]