CVE-2020-27813

Name	CVE-2020-27813
Description	An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2520-1, DLA-3420-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-gorilla-websocket (PTS)	bullseye	1.4.2-1	fixed
	sid, trixie, bookworm	1.5.0-2	fixed
golang-websocket (PTS)	buster	1.4.0-1	vulnerable
	buster (security)	1.4.0-1+deb10u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
golang-github-gorilla-websocket	source	(unstable)	(not affected)
golang-websocket	source	stretch	1.1.0-1+deb9u1	DLA-2520-1
golang-websocket	source	buster	1.4.0-1+deb10u1	DLA-3420-1
golang-websocket	source	(unstable)	(unfixed)

Notes

- golang-github-gorilla-websocket <not-affected> (Fixed with first upload to Debian with renamed source package)
https://github.com/gorilla/websocket/security/advisories/GHSA-jf24-p9p9-4rjh
https://github.com/gorilla/websocket/commit/5b740c29263eb386f33f265561c8262522f19d37 (v1.4.1)