Evolving Threat: http2shell is an RCE in node, Python, and more

I could do without every memory bug getting a cute sensational name and marketing push, I have to say.

There’s apparently no writeup on exactly what was the fix. So I’m going to make a guess that this is the chromium commit that fixed the problem: https://source.chromium.org/chromium/chromium/src/+/224140d4...

And this commit contained a refactoring from BROTLI_BOOL to BrotliDecoderErrorCode so the situation was that probably one of the error conditions previously simply returned false but needed more detail about what went wrong to continue safely.

Well okay this change from `if (prev_ix < cur_ix)` to `if (prev_ix < cur_ix && cached_backward <= max_backward)` is also suspicious and could be an related or unrelated hardening fix.

Here's the normal link:

https://x.com/AikidoSecurity/status/2113759110625906950

It looks like brotli <= 1.2.0 is vulnerable.

The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/

Interestingly the commit that fixes this in brotli dates back to February https://github.com/google/brotli/commit/0ed4268a4401abcb4472...

They just keep coming, don't they?

Since I checked Rust servers should be fine since the brotli crate is not a binding on the C.

Likely mitigation: disable brotli (br) content-encoding on both sides