CVE-2020-8252: Buffer Overflow
A flaw has been found in libuv. The realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
libuv's realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow.
Upstream advisory:
https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/
— Red Hat
Node.js is vulnerable to a buffer overflow, caused by improper bounds checking by the libuv's fs.realpath.native. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service.
— IBM
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8252?
CVE-2020-8252 is a vulnerability in the realpath() implementation in libuv, which can lead to a potential buffer overflow.
What is the impact of CVE-2020-8252?
The highest threat from CVE-2020-8252 is to data confidentiality and integrity, as well as system availability.
Which software is affected by CVE-2020-8252?
Node.js versions < 10.22.1, < 12.18.4, and < 14.9.0, as well as libuv versions < 1.39.0, are affected by CVE-2020-8252.
How can I fix CVE-2020-8252?
To fix CVE-2020-8252, update Node.js to version 10.22.1, 12.18.4, or 14.9.0, and update libuv to version 1.39.0.
Where can I find more information about CVE-2020-8252?
You can find more information about CVE-2020-8252 on the Node.js and libuv websites.