Ubuntu USN-8956-2 brings the Brotli fix to older LTS releases
Ubuntu notice USN-8956-2 extends the Brotli fix to older LTS releases. See who is affected and how to check a server.
TL;DR: Ubuntu notice USN-8956-2 brings the Brotli security fix to the older 16.04 LTS, 18.04 LTS and 20.04 LTS releases. Update the package if you run any of them.
What happened
Ubuntu published USN-8956-2, a follow-up to USN-8956-1. The first notice fixed a Brotli problem on newer releases, and this one carries the same fix to Ubuntu 16.04 LTS, 18.04 LTS and 20.04 LTS. Ubuntu says Brotli mishandled some compressed streams, so a remote attacker could cause a crash or possibly run code. It concerns the same library as the exploited flaw in our Brotli post, though the notice does not name a CVE that we can cite here.
The package version to install is not in our data, so read the notice for it.
Am I affected?
You are if a server or image runs one of those releases and has Brotli installed, directly or as a dependency of a web server or library. Check on one machine:
lsb_release -ds
dpkg -l | grep -i brotli
apt list --upgradable 2>/dev/null | grep -i brotliPrograms that ship their own bundled Brotli copy will not be fixed by the package update.
How to check with Stackurity
Stackurity's read-only agent reads installed packages on Ubuntu and other Linux servers and matches them against vendor advisories every hour, accounting for backports. Libraries copied into an application outside a package manager are not covered. See how verification works and start a free trial.
