id: GO-2020-0019
modules:
    - module: github.com/gorilla/websocket
      versions:
        - fixed: 1.4.1
      vulnerable_at: 1.4.0
      packages:
        - package: github.com/gorilla/websocket
          symbols:
            - Conn.advanceFrame
            - messageReader.Read
          derived_symbols:
            - Conn.Close
            - Conn.NextReader
            - Conn.NextWriter
            - Conn.ReadJSON
            - Conn.ReadMessage
            - Conn.WriteControl
            - Conn.WriteJSON
            - Conn.WriteMessage
            - Conn.WritePreparedMessage
            - Dialer.Dial
            - Dialer.DialContext
            - NewClient
            - NewPreparedMessage
            - ReadJSON
            - Subprotocols
            - Upgrade
            - Upgrader.Upgrade
            - WriteJSON
            - flateReadWrapper.Read
            - flateWriteWrapper.Close
            - flateWriteWrapper.Write
            - httpProxyDialer.Dial
            - messageWriter.Close
            - messageWriter.ReadFrom
            - messageWriter.Write
            - messageWriter.WriteString
            - netDialerFunc.Dial
            - proxy_direct.Dial
            - proxy_envOnce.Get
            - proxy_socks5.Dial
            - truncWriter.Write
summary: Integer overflow in github.com/gorilla/websocket
description: |-
    An attacker can craft malicious WebSocket frames that cause an integer overflow
    in a variable which tracks the number of bytes remaining. This may cause the
    server or client to get stuck attempting to read frames in a loop, which can be
    used as a denial of service vector.
published: 2021-04-14T20:04:52Z
cves:
    - CVE-2020-27813
ghsas:
    - GHSA-3xh2-74w9-5vxm
    - GHSA-jf24-p9p9-4rjh
credits:
    - Max Justicz
references:
    - fix: https://github.com/gorilla/websocket/pull/537
    - fix: https://github.com/gorilla/websocket/commit/5b740c29263eb386f33f265561c8262522f19d37