*** This bug is a security vulnerability *** Public security bug reported:
Release: Ubuntu 20.04 LTS (focal) Package: brotli / libbrotli1 1.0.7-6ubuntu0.1 (current focal-security/focal-updates) Expected: a fix for CVE-2026-111497, as for jammy/noble (USN-8956-1) Actual: no fixed package for focal; Ubuntu CVE tracker shows "Needs evaluation" CVE-2026-111497 (out-of-bounds write in the Brotli decoder, c/dec/decode.c) is fixed for jammy, noble, resolute and later in USN-8956-1, but the Ubuntu CVE tracker still lists brotli in focal as "Needs evaluation", and there is no fixed package for focal / focal ESM yet. The jammy security patch (debian/patches/CVE-2026-111497.patch from 1.0.9-2ubuntu0.1, i.e. upstream commit 50a9b70a4d5e, cherry-pick of 0ed4268a4401) applies to focal's 1.0.7-6ubuntu0.1 source without modification: all hunks apply with line offsets only, no fuzz. The new error code BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17) uses a value that was already reserved in 1.0.7's decode.h, so the ABI is unchanged. Attached is a debdiff against 1.0.7-6ubuntu0.1. It only adds that patch and a changelog entry. The version string in the debdiff (1.0.7-6ubuntu0.1+gelistir1) is our local one; please replace it with whatever is appropriate for ESM (e.g. 1.0.7-6ubuntu0.1+esm1). What we verified: - The same source package was uploaded to our PPA and built on Launchpad (focal amd64); the build runs the upstream test suite, all passing (ctest 70/70, python tests 376 OK): https://launchpad.net/~gelistir/+archive/ubuntu/security/+build/33880680 PPA: https://launchpad.net/~gelistir/+archive/ubuntu/security - Deployed on 9 production focal hosts (LiteSpeed lsphp 7.4/8.2/8.3 and php-fpm 8.2, all linking libbrotlidec via libcurl). Brotli-encoded HTTP responses are decoded correctly through PHP cURL with CURLOPT_ENCODING; no errors or crashes observed. - 20-minute libFuzzer + ASan run of c/fuzz/decode_fuzzer.c against both the unpatched and patched 1.0.7 decoder (~206k and ~238k executions respectively): no findings in either. What we did NOT verify: - We did not reproduce the vulnerability itself (no crash reproducer). The confidence comes from the patch being identical to the one Canonical already shipped for jammy (1.0.9), applied cleanly. Notes for users of focal: - Processes that loaded the old library (php-fpm, LiteSpeed lsphp, long-running PHP workers, etc.) keep using it until restarted; check with: grep -l 'libbrotli.*(deleted)' /proc/[0-9]*/maps - nodejs in focal uses its own vendored brotli and is not covered by this package. -- Mehmet Ali UYSAL, Gelistir (https://gelistir.com.tr) ** Affects: brotli (Ubuntu) Importance: Undecided Status: New ** Tags: focal patch ** Patch added: "debdiff against 1.0.7-6ubuntu0.1 (adds CVE-2026-111497.patch from jammy)" https://bugs.launchpad.net/bugs/2172396/+attachment/6013159/+files/brotli_focal_CVE-2026-111497.debdiff ** Information type changed from Private Security to Public Security ** CVE added: https://cve.org/CVERecord?id=CVE-2026-111497 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172396 Title: CVE-2026-111497: backport of jammy fix for brotli 1.0.7 in focal To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/brotli/+bug/2172396/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
