CVE-2020-8277

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 19-11-2020 02:15

Last modified: - 10-05-2022 05:25

Total changes: - 12

Description

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Low

Attack complexity

Network

Attack vector

High

Availability

None

Confidentiality

None

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

7.5

Base score

3.9

3.6

Exploitability score

Impact score

Verification logic

vendor=nodejs AND product=node.js AND software_edition=- AND versionStartIncluding=15.0.0 AND versionEndExcluding=15.2.1

vendor=nodejs AND product=node.js AND software_edition=lts AND versionStartIncluding=14.13.0 AND versionEndExcluding=14.15.1

vendor=nodejs AND product=node.js AND software_edition=lts AND versionStartIncluding=12.16.3 AND versionEndExcluding=12.19.1

vendor=fedoraproject AND product=fedora AND version=32

vendor=fedoraproject AND product=fedora AND version=33

vendor=oracle AND product=graalvm AND version=19.3.4 AND software_edition=enterprise

vendor=oracle AND product=graalvm AND version=20.3.0 AND software_edition=enterprise

vendor=oracle AND product=retail_xstore_point_of_service AND version=16.0.6

vendor=oracle AND product=retail_xstore_point_of_service AND version=17.0.4

vendor=oracle AND product=retail_xstore_point_of_service AND version=18.0.3

vendor=oracle AND product=retail_xstore_point_of_service AND version=19.0.2

vendor=oracle AND product=jd_edwards_enterpriseone_tools AND versionEndExcluding=9.2.6.0

vendor=oracle AND product=mysql_cluster AND versionEndIncluding=8.0.23

vendor=oracle AND product=blockchain_platform AND versionEndExcluding=21.1.2

vendor=c-ares_project AND product=c-ares AND versionEndExcluding=1.16.0

Reference

https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/
https://hackerone.com/reports/1033107
FEDORA-2020-7473744de1-Mailing List, Third Party Advisory
FEDORA-2020-307e873389-Mailing List, Third Party Advisory
GLSA-202012-11-Third Party Advisory
GLSA-202101-07-Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
FEDORA-2021-ee913722db-Mailing List, Third Party Advisory
FEDORA-2021-afed2b904e-Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
N/A-Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpuapr2022.html

Keywords

CVE-2020-8277

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2020-8277

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures