rpms/brotli
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: RHEL-133995

Browse Source 
CVE-2025-6176 Brotli decompression bomb DoS in scrapy
This commit is contained in:
Parag Nemade 2026-01-18 13:59:25 +05:30
parent 7cd3de7b8d
commit 44f5f36283
No known key found for this signature in database
GPG Key ID: 71932951EB71E972
2 changed files with 2185 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2178
CVE-2025-6176.patch Normal file
View File

File diff suppressed because it is too large Load Diff

9
brotli.spec
View File

@ -1,6 +1,6 @@
Name: brotli
Version: 1.0.9
Release: 7%{?dist}
Release: 8%{?dist}
Summary: Lossless compression algorithm
License: MIT
@ -8,7 +8,8 @@ URL: https://github.com/google/brotli
Source0: %{url}/archive/v%{version}/%{name}-%{version}.tar.gz
Patch0: 09b0992b6acb7faa6fd3b23f9bc036ea117230fc.patch
Patch1: RHEL-32153-kBrotliBitMask-bounds.patch
Patch1: RHEL-32153-kBrotliBitMask-bounds.patch
Patch2: CVE-2025-6176.patch
%if 0%{?rhel} == 7
BuildRequires: devtoolset-7-toolchain, devtoolset-7-libatomic-devel
@ -140,6 +141,10 @@ done
%changelog
* Sun Jan 18 2026 Parag Nemade <pnemade AT redhat DOT com> - 1.0.9-8
- Resolves: RHEL-133995
CVE-2025-6176 Brotli decompression bomb DoS in scrapy
* Wed Sep 11 2024 Eike Rathke <erack@redhat.com> - 1.0.9-7
- Check BitMask(n) n value for kBrotliBitMask[n] bounds