CVE-2020-8277: Buffer Overflow
First published: Thu Nov 12 2020(Updated: )
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/rh-nodejs12-nodejs | <0:12.19.1-2.el7 | 0:12.19.1-2.el7 |
| redhat/rh-nodejs14-nodejs | <0:14.15.4-2.el7 | 0:14.15.4-2.el7 |
| Nodejs Node.js | >=12.16.3<12.19.1 | |
| Nodejs Node.js | >=14.13.0<14.15.1 | |
| Nodejs Node.js | >=15.0.0<15.2.1 | |
| Fedoraproject Fedora | =32 | |
| Fedoraproject Fedora | =33 | |
| Oracle Blockchain Platform | <21.1.2 | |
| Oracle GraalVM | =19.3.4 | |
| Oracle GraalVM | =20.3.0 | |
| Oracle Jd Edwards Enterpriseone Tools | <9.2.6.0 | |
| Oracle MySQL Cluster | <=8.0.23 | |
| Oracle Retail Xstore Point of Service | =16.0.6 | |
| Oracle Retail Xstore Point of Service | =17.0.4 | |
| Oracle Retail Xstore Point of Service | =18.0.3 | |
| Oracle Retail Xstore Point of Service | =19.0.2 | |
| C-ares Project C-ares | <1.16.0 | |
| redhat/c-ares | <1.17.0 | 1.17.0 |
| <=1.6.0.1 | ||
| <=1.6.0.0 | ||
| <=1.5.0.1 | ||
| <=1.5.0.0 | ||
| <=1.4.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-8277 https://nvd.nist.gov/vuln/detail/CVE-2020-8277
- https://bugzilla.redhat.com/show_bug.cgi?id=1898554
- https://access.redhat.com/errata/RHSA-2020:5499
- https://access.redhat.com/errata/RHSA-2021:0551
- https://access.redhat.com/errata/RHSA-2020:5305
- https://access.redhat.com/errata/RHSA-2021:0421
- https://access.redhat.com/security/cve/cve-2020-8277
- https://hackerone.com/reports/1033107
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/
- https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/
- https://security.gentoo.org/glsa/202012-11
- https://security.gentoo.org/glsa/202101-07
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/c-ares/c-ares/issues/371
- https://github.com/c-ares/c-ares/commit/0d252eb3b2147179296a3bdb4ef97883c97c54d3
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1898556
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1898557
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1898558
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1898559
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1898561
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1898562
- https://exchange.xforce.ibmcloud.com/vulnerabilities/191755
- https://www.ibm.com/support/pages/node/6453115 (Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2020-8277?
CVE-2020-8277 is a vulnerability in Node.js that allows an attacker to trigger a Denial of Service by getting the application to resolve a DNS record with a larger number of responses.
Which versions of Node.js are affected by CVE-2020-8277?
Versions < 15.2.1, < 14.15.1, and < 12.19.1 of Node.js are affected by CVE-2020-8277.
How can I fix CVE-2020-8277?
To fix CVE-2020-8277, update your Node.js installation to version 15.2.1, 14.15.1, or 12.19.1 or higher.
What is the severity of CVE-2020-8277?
CVE-2020-8277 has a severity of 7.5 (high).
Where can I find more information about CVE-2020-8277?
More information about CVE-2020-8277 can be found on the GitHub page and the Red Hat Bugzilla page.
- collector/redhat-cve
- agent/type
- agent/remedy
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-8277
- agent/description
- agent/softwarecombine
- collector/ibm-support
- source/IBM
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/tags
- agent/event
- agent/trending
- package-manager/redhat
- vendor/nodejs
- canonical/nodejs node.js
- version/nodejs node.js/12.16.3
- version/nodejs node.js/14.13.0
- version/nodejs node.js/15.0.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/32
- version/fedoraproject fedora/33
- vendor/oracle
- canonical/oracle blockchain platform
- canonical/oracle graalvm
- version/oracle graalvm/19.3.4
- version/oracle graalvm/20.3.0
- canonical/oracle jd edwards enterpriseone tools
- canonical/oracle mysql cluster
- version/oracle mysql cluster/8.0.23
- canonical/oracle retail xstore point of service
- version/oracle retail xstore point of service/16.0.6
- version/oracle retail xstore point of service/17.0.4
- version/oracle retail xstore point of service/18.0.3
- version/oracle retail xstore point of service/19.0.2
- vendor/c-ares project
- canonical/c-ares project c-ares
- vendor/ibm
- canonical/ibm cloud pak for security (cp4s)
- version/ibm cloud pak for security (cp4s)/1.6.0.1
- version/ibm cloud pak for security (cp4s)/1.6.0.0
- version/ibm cloud pak for security (cp4s)/1.5.0.1
- version/ibm cloud pak for security (cp4s)/1.5.0.0
- version/ibm cloud pak for security (cp4s)/1.4.0.0