Brotli security update

Note

These steps apply only to Opsview 6.10.1 to 6.12.6. An upcoming Opsview upgrade will install the fixed Brotli library automatically. You do not need to follow the steps on this page after that upgrade.

On Opsview Cloud, ITRS manages and updates the Orchestrator, so no action is required on it. However, you must still carry out the mitigation steps below on each of your Collectors.

ITRS has reviewed a recently disclosed vulnerability in Brotli, CVE-2026-111497, also known as node2shell, http2shell, or broccoli2shell. The vulnerability is an out-of-bounds write in the Brotli decoder, the part of the library that reads compressed data. This means the library can write data outside the memory area reserved for it. Specially crafted Brotli-compressed data can corrupt memory, expose memory contents, cause a denial of service, or potentially let a malicious party run code on the host. Brotli versions 1.0.3 to 1.2.0 are affected. Brotli version 1.2.1 fixes the issue. For more information, see the CVE record.

How Opsview is affected Copied

Opsview includes Brotli 1.1.0 in its Python environment, which is installed in /opt/opsview/python3 by the opsview-python3-modules package. Python libraries that Opsview uses to make web requests, such as urllib3, requests, and aiohttp, use Brotli automatically when it is installed. This creates two ways that a malicious party could send data to the vulnerable library:

• Responses from external servers — Plugins, notification scripts, and other Opsview components that make outbound web requests can receive and decompress Brotli data. To exploit this, a malicious party would need to control a server that Opsview connects to, or be able to intercept traffic between Opsview and that server.
• The local opsview-sys service — This internal service listens on localhost:8185 and can decompress Brotli data sent to it. To exploit this, a malicious party would need local access to the Opsview host.

The following components are not affected or have a separate fix:

• The Node.js runtime included with Opsview is not affected.
• Infrastructure Agent builds earlier than 2.14.17240 include an affected Brotli library. Upgrade these agents to build 2.14.17240 or later. For more information, see Infrastructure Agent 2.14 release notes.

Temporary mitigation Copied

Until an Opsview release includes the fixed library, install Brotli 1.2.1 into the Opsview Python environment to mitigate the vulnerability. The install command checks the package against the SHA-256 hash in the requirements file, so it installs only the expected Brotli package for Python 3.9 on x86_64 (64-bit Intel and AMD) systems. Do not remove the hash from the requirements file.

Carry out these steps on every Collector. For Opsview On-Premises, also carry out these steps on the Orchestrator.

Before you start, note the following:

• The steps use pip3, the Python package installer included with Opsview, to download Brotli from the Python Package Index (PyPI). If the host cannot connect to PyPI, follow Install Brotli without internet access instead.
• The requirements file includes a SHA-256 hash, which is a unique fingerprint of the expected Brotli package. The install command checks this hash and refuses any file that does not match, so you only install the official Python 3.9 x86_64 package. Do not remove the hash.
• If the host connects to the internet through a proxy server, add --proxy <proxy-url> to the pip3 commands, for example --proxy http://proxy.example.com:8080.
• The procedure restarts Opsview, so carry out these steps during a planned maintenance window.

Install Brotli 1.2.1 Copied

Use this procedure when the Opsview host can connect to PyPI.

1. Make sure a backup is available before you change the system.

2. Save the following requirements file as /tmp/brotli-1.2.1.txt:

   Brotli==1.2.1 \
       --hash=sha256:ddc832886517c5009863209a4a292c4353967cd304ba55822d533e0d59eb6a60
   

3. Install the Brotli package:

   sudo /opt/opsview/python3/bin/pip3 install --upgrade --no-deps --only-binary=:all: --require-hashes -r /tmp/brotli-1.2.1.txt
   

Confirm the installation Copied

1. Confirm that Brotli 1.2.1 is installed. The following command must print 1.2.1:

   /opt/opsview/python3/bin/python3 -c "import brotli; print(brotli.__version__)"
   

2. Restart Opsview so that its processes load the new library:

   sudo /opt/opsview/watchdog/bin/opsview-monit restart all
   

3. Confirm that Opsview is running and that you can log in.

Install Brotli without internet access Copied

Use this procedure when the Opsview host cannot connect to PyPI. Download the package on another machine that has internet access and Python 3 installed.

1. Make sure a backup is available before you change the system.

2. On the Opsview host, save the following requirements file as /tmp/brotli-1.2.1.txt:

   Brotli==1.2.1 \
       --hash=sha256:ddc832886517c5009863209a4a292c4353967cd304ba55822d533e0d59eb6a60
   

3. Copy /tmp/brotli-1.2.1.txt to the connected machine.

4. On the connected machine, download the package:

   python3 -m pip download --no-deps --only-binary=:all: --python-version 39 --implementation cp --abi cp39 --platform manylinux2014_x86_64 --require-hashes -r /tmp/brotli-1.2.1.txt -d /tmp/brotli-1.2.1
   

5. Copy the /tmp/brotli-1.2.1.txt file and the /tmp/brotli-1.2.1 directory to the same locations on the Opsview host.

6. On the Opsview host, install the package from the copied files:

   sudo /opt/opsview/python3/bin/pip3 install --upgrade --no-index --no-deps --only-binary=:all: --require-hashes --find-links=/tmp/brotli-1.2.1 -r /tmp/brotli-1.2.1.txt
   

7. Continue with Confirm the installation.

Reduce exposure until the next upgrade Copied

If you are unable to upgrade the Brotli library to 1.2.1 with the mitigation steps, take these actions to reduce risk until you upgrade to an Opsview release that includes the fixed library:

• Limiting local shell access to the Orchestrator (for Opsview On-Premises) and Collector hosts to the users who need it.
• Making sure that plugins and notification scripts connect only to servers you trust.