OpenAI 红队测试发现 Brotli 未认证远程代码执行漏洞并已披露
TL;DR · AI 摘要
OpenAI 红éæµè¯åç° Brotli æªè®¤è¯è¿ç¨ä»£ç æ§è¡æ¼æ´å¹¶å·²æ«é² · AIHOT OpenAI · @ · X · 2026-10-24 0...
核心要点
- 主题聚焦：OpenAI 红队测试发现 Brotli 未认证远程代码执行漏洞并已披露
- 来源：AI HOT 精选，建议结合原文判断细节。
- AI 分析暂不可用，本条为保底评分与摘要。
OpenAI 红éæµè¯åç° Brotli æªè®¤è¯è¿ç¨ä»£ç æ§è¡æ¼æ´å¹¶å·²æ«é² · AIHOT
OpenAI
· @
· X
·
2026-10-24 06:55
3 å°æ¶å
ç²¾é
AI è¯å
85
AI 导读
OpenAI å ¬å¸å ¶å¨çº¢éæ¼ç»ä¸åç° Brotli å缩åºåå¨æªè®¤è¯è¿ç¨ä»£ç æ§è¡æ¼æ´ï¼æ»å»è å¯éè¿åéæåå¤æ¶æå缩æ°æ®å¨åå½±åç³»ç»ä¸æ§è¡ä»£ç ï¼æ éå建ç¨æ·è´¦å·ï¼å½±å Node.jsãBunãEnvoy çå åµ Brotli ç软件ï¼æªæè¡¥ä¸çæ¥åå缩è¾å ¥çæå¡å¨ï¼å¦æ¥å curl --compressed ç客æ·ç«¯ï¼å¯è¢«æ¶æ对端æ¥ç®¡ã
æ¨èçç±
OpenAI å ¬å¸çº¢éæµè¯ä¸åç°ç Brotli æªè®¤è¯è¿ç¨ä»£ç æ§è¡æ¼æ´ç»èï¼Node.jsãBunãEnvoy çä¸æ¸¸è½¯ä»¶éè·è¿æ´æ°ã
æ£æ · AI ç¿»è¯
å¨è¿æ¬¡çº¢éæ¼ç»ä¸ï¼æ们è¿åç°äºä¸ä¸ªæ¼æ´ï¼å¯å¨ Brotli ä¸å®ç°æªç»èº«ä»½éªè¯çè¿ç¨ä»£ç æ§è¡ãBrotli æ¯ä¸ä¸ªè¢«å¹¿æ³é¨ç½²çå缩åºï¼å å«å¨è®¸å¤è½¯ä»¶ä¸ï¼ä¾å¦ Node.jsãBun å Envoyã
该缺é·å¯è®©æ»å»è éè¿åéæåå¤æ¶æå缩æ°æ®ï¼å¨åå½±åç³»ç»ä¸è¿è¡èªå·±ç代ç ï¼èæ éå建任ä½ç¨æ·è´¦æ·ãä¹å°±æ¯è¯´ï¼ä¸ä¸ªæ¥åå缩è¾å ¥çæªä¿®è¡¥æå¡å¨å¯è½è¢«æ¶æ客æ·ç«¯æ¥ç®¡ï¼èä¸ä¸ªæ¥åå缩è¾å ¥çæªä¿®è¡¥å®¢æ·ç«¯ï¼ä¾å¦âcurl --compressedâï¼å¯è½è¢«æ¶ææå¡å¨æ¥ç®¡ã
è¿ä¸ªæ ¹æ¬åå é®é¢å®é ä¸å·²äºäºæä»½å¨ Brotli æºä»£ç ä¸ä¿®å¤ï¼ä½å½æ¶å¹¶ä¸ç¥éå®ä¼å¯¼è´å®å ¨æ¼æ´ï¼èä¸ Brotli æ¤åä¹æ²¡æååå¸æ°çæ¬ãç±äº Brotli å ç½®äºå ¶ä»è½¯ä»¶ä¸ï¼ä»»ä½å å«è¯¥åºç软件ä¹éè¦éç¨è¯¥æ´æ°ï¼éåæ¯è¯¥è½¯ä»¶çç¨æ·ãæ们å Brotli åå ¶ä»ä¸æ¸¸é¡¹ç®ï¼å¦ Node.jsï¼æ«é²äºè¯¥æ¼æ´ï¼åè å·²åå¸ææ£å¨åå¸å®å ¨æ´æ°ï¼Brotli ä¹åå¸äºæ°çæ¬å¹¶å ¬å¸äº CVEã
æå ³è¡¥ä¸åç¼è§£æªæ½çæ´å¤ç»èå¦ä¸ï¼ https://patchtheplanet.org/brotli
å¼ç¨ OpenAI @ OpenAI
è¿å»å 个æéï¼æä»¬å¤§å¹ å¼ºåäºç 究è®ç»ç¯å¢çå®å ¨æ§ãæ们已移é¤ææå沿模åå¨è®ç»æé´çå®æ¶äºèç½è®¿é®ï¼å¹¶ä¸ºå®ä»¬æ建äºä¸ä¸ªç¦»çº¿ä¸çæ¥æ¿ä»£ââä¸ä¸ªç¼åçç½ç»çæ¬ï¼å®ä»¬ä»å¯å¨å ¶ä¸å¦ä¹ æµè§ãæç´¢å使ç¨åºç¨ç¨åºã 9æ20æ¥ï¼å¨ä¸ä¸ªæ¨¡åå©ç¨ DNS é ç½®é误æ¾å°éåºè¿ä¸ªç¦»çº¿ä¸ççæ¹æ³åï¼æ们æåäºå沿è®ç»ï¼ä»¥è¿ä¸æ¥å 强é离ãæ们ç»å»ºäºç±æ们æå ·ç½ç»è½åç模å驱å¨çæºè½ä½å¢éï¼å¹¶è®©å®ä»¬å¯»æ¾æ们ç 究ç¯å¢ä¸çå¼±ç¹ã 尽管å®ä»¬æ²¡ææ¾å°æ¢è½è½»æå©ç¨ãåè½åæ们ççæ§éèå ¶æ´»å¨çéå¾äºèç½çè·¯å¾ï¼ä½å®ä»¬ç¡®å®åç°äºé¶æ¥æ¼æ´ãèææºéé¸ï¼ä»¥åæºè½ä½ä¹é´éä¿¡ç硬件侧信éãæ们å©ç¨å®ä»¬çåç°è¿ä¸æ¥å 强äºé²å¾¡ï¼å¹¶ä¸ºå¼æºè½¯ä»¶è´¡ç®äºä¿®å¤ã å¨å¼ºåæ们çé离æ¶æåï¼æ们äº10æ1æ¥æ¢å¤äºå沿强åå¦ä¹ è®ç»åæ¨çãæ们é¢çäºå¤§éç®åç¨äºæç»ç红éæµè¯ï¼å¹¶å°é«ç®å红éæµè¯çº³å ¥æ们ç¨æ¥å³å®å沿è®ç»åè¯ä¼°è½å¦å®å ¨æ¨è¿çå®å ¨è®ºè¯ä¸ã https://openai.com/index/securing-our-frontier-model-training-environment/
åæ
Over the past several months, we have substantially hardened the security of our research training environment. Weâve removed live internet access for all frontier models during training and built an offline world for them to use insteadâa cached version of the web where they can still learn to browse, search, and use applications. On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments. While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software. After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. Weâve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely. https://openai.com/index/securing-our-frontier-model-training-environment/
å¨ X æ¥ç被å¼ç¨çå¸å
æ¥æºï¼ OpenAI · x.com
OpenAI / ChatGPT
å®å ¨å¯¹é½
è¡ä¸å¨æ
#
å®å ¨/对é½