Package: libwebkit2gtk-4.0-37 Version: 2.30.3-1~deb10u1 Severity: normal Dear Maintainer,
Since the last libwebkit update in buster, there is a (possibly information-disclosing) bug in the websockets implementation. For instance when a client sends, in order, the strings "disabled", "d20", "NOP" and "NOP", what the server receives in one run is 'disablede/im0' 'd20\x01\x17' 'NOPablede/im0' 'NOP\x01\x1e' A repetition might yield 'disable' 'd20' 'enablee' 'NOPblee' -- which not only breaks the websocket application but also might lead to disclosing parts of memory that the server probably shouldn't be seeing. Steps to reproduce: (1) get a browser using libwebkit2gtk-4.0.37 (I used luakit) (2) connect to any websocket echo service (I used https://www.websocket.org/echo.html) (3) Type a few messages of varying length and spot the replies contain extra bytes. Actually, in these tests I noticed that there's probably more awry in that the websocket connection after a few messages apparently becomes unresponsive. -- System Information: Debian Release: 10.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: i386 (x86_64) Foreign Architectures: amd64 Kernel: Linux 5.8.0-0.bpo.2-amd64 (SMP w/4 CPU cores) Kernel taint flags: TAINT_USER, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Init: sysvinit (via /sbin/init) Versions of packages libwebkit2gtk-4.0-37 depends on: ii bubblewrap 0.3.1-4 ii libatk1.0-0 2.30.0-2 ii libc6 2.28-10 ii libcairo-gobject2 1.16.0-4 ii libcairo2 1.16.0-4 ii libegl1 1.1.0-1 ii libenchant1c2a 1.6.0-11.1+b1 ii libfontconfig1 2.13.1-2 ii libfreetype6 2.9.1-3+deb10u2 ii libgcc1 1:8.3.0-6 ii libgcrypt20 1.8.4-5 ii libgdk-pixbuf2.0-0 2.38.1+dfsg-1 ii libgl1 1.1.0-1 ii libglib2.0-0 2.58.3-2+deb10u2 ii libgstreamer-gl1.0-0 1.14.4-2 ii libgstreamer-plugins-base1.0-0 1.14.4-2 ii libgstreamer1.0-0 1.14.4-1 ii libgtk-3-0 3.24.5-1 ii libharfbuzz-icu0 2.3.1-1 ii libharfbuzz0b 2.3.1-1 ii libhyphen0 2.8.8-7 ii libicu63 63.1-6+deb10u1 ii libjavascriptcoregtk-4.0-18 2.30.3-1~deb10u1 ii libjpeg62-turbo 1:1.5.2-2+b1 ii libnotify4 0.7.7-4 ii libopenjp2-7 2.3.0-2+deb10u1 ii libpango-1.0-0 1.42.4-8~deb10u1 ii libpangocairo-1.0-0 1.42.4-8~deb10u1 ii libpng16-16 1.6.36-6 ii libseccomp2 2.3.3-4 ii libsecret-1-0 0.18.7-1 ii libsoup2.4-1 2.64.2-2 ii libsqlite3-0 3.27.2-3 ii libstdc++6 8.3.0-6 ii libsystemd0 241-7~deb10u4 ii libtasn1-6 4.13-3 ii libwayland-client0 1.16.0-1 ii libwayland-egl1 1.16.0-1 ii libwayland-server0 1.16.0-1 ii libwebp6 0.6.1-2 ii libwebpdemux2 0.6.1-2 ii libwoff1 1.0.2-1 ii libx11-6 2:1.6.7-1+deb10u1 ii libxcomposite1 1:0.4.4-2 ii libxdamage1 1:1.1.4-3+b3 ii libxml2 2.9.4+dfsg1-7+b3 ii libxrender1 1:0.9.10-1 ii libxslt1.1 1.1.32-2.2~deb10u1 ii libxt6 1:1.1.5-1+b3 ii xdg-dbus-proxy 0.1.1-1 ii zlib1g 1:1.2.11.dfsg-1 Versions of packages libwebkit2gtk-4.0-37 recommends: ii gstreamer1.0-alsa 1.14.4-2 pn gstreamer1.0-gl <none> ii gstreamer1.0-libav 1.15.0.1+git20180723+db823502-2 ii gstreamer1.0-plugins-good 1.14.4-1 ii gstreamer1.0-pulseaudio 1.14.4-1 ii libgl1-mesa-dri 18.3.6-2+deb10u1 libwebkit2gtk-4.0-37 suggests no packages. -- no debconf information
