Greg Brockman says discovery and advancement of compression library RCE vulnerability disclosure

Oct 24

1. 09:24

   Matthew Prince 🌥Related discussion

   Matthew Prince 🌥 joined this discussion ↗

   This post contributes to heat; it is not a formal report or confirmed fact.

2. 07:25

   Greg BrockmanSelected

   OpenAI discloses remote code execution vulnerability in Brotli compression library

   OpenAI discovered during a red team exercise that the Brotli compression library has a vulnerability allowing unauthenticated remote code execution; an attacker can run code on affected systems by sending or replying with malicious compressed data. The root-cause issue was fixed in the Brotli source code in February, but at the time it was not known to constitute a security vulnerability and no new version has been released since; OpenAI has disclosed it to Brotli and downstream projects such as Node.js, and Brotli has released a new version and published a CVE. Greg Brockman said this also illustrates the complexity of patch coordination, because the library is integrated into a large amount of downstream software.

   Expand summary
3. 06:55

   OpenAIFirst-partySelected

   OpenAI red team exercise discovered Brotli unauthenticated remote code execution vulnerability

   During a red team exercise, OpenAI discovered an unauthenticated remote code execution vulnerability in the Brotli compression library. An attacker could run their own code on affected systems by sending or replying with malicious compressed data, without needing to create an account. The root cause was already fixed in the Brotli source code in February, but at the time it was not recognized as constituting a security vulnerability, and no new version had been released since; OpenAI has disclosed it to Brotli and downstream projects such as Node.js, Brotli has released a new version and published a CVE, and Node.js has released or is releasing security updates.

   Expand summary