CVE-2020-27813 - OpenCVE

An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:L/Au:N/C:N/I:N/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Debian	Debian Linux
Gorillatoolkit	Websocket

Configuration 1 [-]

cpe:2.3:a:gorillatoolkit:websocket:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1902111	Issue Tracking Third Party Advisory
https://github.com/gorilla/websocket/security/advisories/GHSA-jf24-p9p9-4rjh	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00008.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00012.html

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: redhat

Published: 2020-12-02T00:00:00

Updated: 2023-05-14T00:00:00

Reserved: 2020-10-27T00:00:00

Link: CVE-2020-27813

JSON object: View

NVD Information

Status : Modified

Published: 2020-12-02T01:15:12.780

Modified: 2023-11-07T03:21:01.617

Link: CVE-2020-27813

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gorillatoolkit:websocket:*:*:*:*:*:*:*:*", "matchCriteriaId": "352B9531-5BB0-4C4D-9A9F-6E2B27A0B2C0", "versionEndExcluding": "1.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de desbordamiento de enteros con la longitud de las tramas de websocket recibidos por medio de una conexi\u00f3n de websocket. Un atacante podr\u00eda usar este fallo para causar un ataque de denegaci\u00f3n de servicio en un Servidor HTTP permitiendo conexiones websocket"}], "id": "CVE-2020-27813", "lastModified": "2023-11-07T03:21:01.617", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-12-02T01:15:12.780", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1902111"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://github.com/gorilla/websocket/security/advisories/GHSA-jf24-p9p9-4rjh"}, {"source": "secalert@redhat.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00008.html"}, {"source": "secalert@redhat.com", "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00012.html"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-400"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-190"}], "source": "secalert@redhat.com", "type": "Secondary"}]}