CVE-2020-8277: Denial of Service through DNS request

Q: What is CVE-2020-8277?

CVE-2020-8277 is a vulnerability in Node.js that allows an attacker to trigger a Denial of Service by getting the application to resolve a DNS record with a larger number of responses.

Q: Which versions of Node.js are affected by CVE-2020-8277?

Versions < 15.2.1, < 14.15.1, and < 12.19.1 of Node.js are affected by CVE-2020-8277.

Q: How can I fix CVE-2020-8277?

To fix CVE-2020-8277, update your Node.js installation to version 15.2.1, 14.15.1, or 12.19.1 or higher.

Q: What is the severity of CVE-2020-8277?

CVE-2020-8277 has a severity of 7.5 (high).

Q: Where can I find more information about CVE-2020-8277?

More information about CVE-2020-8277 can be found on the GitHub page and the Red Hat Bugzilla page.

Published Nov 12, 2020

Updated

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of service by getting the application to resolve a DNS record with a larger number of responses.

Versions 12.16.3 and higher on the 12.x release line

Versions 14.13.0 and higher on the 14.x release line

All versions of the 15.x release line

Other sources

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

Denial of Service through DNS request (High). A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service by getting the application to resolve a DNS record with a larger number of responses.

Reference: https://github.com/c-ares/c-ares/issues/371

Upstream patch: https://github.com/c-ares/c-ares/commit/0d252eb3b2147179296a3bdb4ef97883c97c54d3

— Red Hat

Node.js is vulnerable to a denial of service. By getting the application to resolve a DNS record with a larger number of responses, an attacker could exploit this vulnerability to trigger a DNS request for a host of their choice resulting in a denial of service.

— IBM

Affected Software

53 affected componentsFixes available

redhat/rh-nodejs12-nodejs<0:12.19.1-2.el7

0:12.19.1-2.el7

redhat/rh-nodejs14-nodejs<0:14.15.4-2.el7

0:14.15.4-2.el7

redhat/c-ares<1.17.0

1.17.0

IBM Cloud Pak for Security (CP4S)<=1.6.0.1

IBM Cloud Pak for Security (CP4S)<=1.6.0.0

IBM Cloud Pak for Security (CP4S)<=1.5.0.1

IBM Cloud Pak for Security (CP4S)<=1.5.0.0

IBM Cloud Pak for Security (CP4S)<=1.4.0.0

Nodejs Node.js>=12.16.3<12.19.1

Nodejs Node.js>=14.13.0<14.15.1

Nodejs Node.js>=15.0.0<15.2.1

Fedoraproject Fedora=32

Fedoraproject Fedora=33

Oracle Blockchain Platform<21.1.2

Oracle GraalVM=19.3.4

Oracle GraalVM=20.3.0

Oracle JD Edwards EnterpriseOne Tools<9.2.6.0

Oracle MySQL Cluster<=8.0.23

Oracle Retail Xstore Point of Service=16.0.6

Oracle Retail Xstore Point of Service=17.0.4

Oracle Retail Xstore Point of Service=18.0.3

Oracle Retail Xstore Point of Service=19.0.2

C-ares Project C-ares<1.16.0

Node.js Node.js>=12.0.0<12.19.1, >=14.0.0<14.15.1, >=15.0.0<15.2.1

12.19.114.15.115.2.1

Node.js Node.js>=12.0.0<12.19.1

12.19.1

Node.js Node.js>=14.0.0<14.15.1

14.15.1

Node.js Node.js>=15.0.0<15.2.1

15.2.1

alpine/nodejs<12.20.1-r0

12.20.1-r0

alpine/nodejs<12.20.1-r0

12.20.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0

alpine/nodejs<14.15.1-r0

14.15.1-r0