CVE-2020-27813
published 2020-12-02CVE-2020-27813: An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.12%
80.0th percentile
An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | golang-github-gorilla-websocket | — | — |
| github.com | gorilla_websocket | >= 0 < 1.4.1 | 1.4.1 |
| gorillatoolkit | websocket | < 1.4.1 | 1.4.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Integer overflow in github.com/gorilla/websocket
ghsa·2021-05-18
CVE-2020-27813 [HIGH] CWE-190 Integer overflow in github.com/gorilla/websocket
Integer overflow in github.com/gorilla/websocket
An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.
OSV
Integer overflow in github.com/gorilla/websocket
osv·2021-05-18
CVE-2020-27813 [HIGH] Integer overflow in github.com/gorilla/websocket
Integer overflow in github.com/gorilla/websocket
An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.
OSV
Integer overflow in github.com/gorilla/websocket
osv·2021-04-14
CVE-2020-27813 Integer overflow in github.com/gorilla/websocket
Integer overflow in github.com/gorilla/websocket
An attacker can craft malicious WebSocket frames that cause an integer overflow in a variable which tracks the number of bytes remaining. This may cause the server or client to get stuck attempting to read frames in a loop, which can be used as a denial of service vector.
OSV
CVE-2020-27813: An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection
osv·2020-12-02·CVSS 7.5
CVE-2020-27813 [HIGH] CVE-2020-27813: An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection
An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.
Ubuntu
Gorilla WebSocket vulnerability
vendor_ubuntu·2023-07-06
CVE-2020-27813 Gorilla WebSocket vulnerability
Title: Gorilla WebSocket vulnerability
Summary: Gorilla WebSocket could be made to crash if it received specially crafted
network traffic.
It was discovered that Gorilla WebSocket incorrectly handled decoding WebSocket
frames. An attacker could possibly use this issue to cause a crash, resulting
in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2020-27813: golang-github-gorilla-websocket - An integer overflow vulnerability exists with the length of websocket frames rec...
vendor_debian·2020·CVSS 7.5
CVE-2020-27813 [HIGH] CVE-2020-27813: golang-github-gorilla-websocket - An integer overflow vulnerability exists with the length of websocket frames rec...
An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Red Hat
golang-github-gorilla-websocket: integer overflow leads to denial of service
vendor_redhat·2019-08-25·CVSS 7.5
CVE-2020-27813 [HIGH] CWE-190 golang-github-gorilla-websocket: integer overflow leads to denial of service
golang-github-gorilla-websocket: integer overflow leads to denial of service
An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.
An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker could use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.
Package: knative-serving (OpenShift Serverless) - Not affected
Package: servicemesh (OpenShift Service Mesh 1) - Not affected
Package: servicemesh-grafana (OpenShift Service Mesh 1) - Will not fix
Package: servicemesh-operator (OpenShift Service Mesh 1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1902111https://github.com/gorilla/websocket/security/advisories/GHSA-jf24-p9p9-4rjhhttps://lists.debian.org/debian-lts-announce/2021/01/msg00008.htmlhttps://lists.debian.org/debian-lts-announce/2023/05/msg00012.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1902111https://github.com/gorilla/websocket/security/advisories/GHSA-jf24-p9p9-4rjhhttps://lists.debian.org/debian-lts-announce/2021/01/msg00008.htmlhttps://lists.debian.org/debian-lts-announce/2023/05/msg00012.html
2020-12-02
Published