CVE-2020-8277
High
Description
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
SeverityHigh
CVSS7.5
Exploit probability99. percentile54.2%
Product
Nodejs Node.js
PublishedNov 19, 2020
First seenNov 19, 2020
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- nodejs node.js12.19.1, 14.15.1, 15.2.1 or later
- oracle blockchain_platform21.1.2 or later
- oracle jd_edwards_enterpriseone_tools9.2.6.0 or later
- c-ares_project c-ares1.16.0 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/
- security.gentoo.org/glsa/202012-11
- security.gentoo.org/glsa/202101-07
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs node.js | 12.16.3 ≤ v < 12.19.1, 14.13.0 ≤ v < 14.15.1, 15.0.0 ≤ v < 15.2.1 | 12.19.1, 14.15.1, 15.2.1 |
| fedoraproject fedora | 32, 33 | — |
| oracle blockchain_platform | v < 21.1.2 | 21.1.2 |
| oracle graalvm | 19.3.4, 20.3.0 | — |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.6.0 | 9.2.6.0 |
| oracle mysql_cluster | v ≤ 8.0.23 | — |
| oracle retail_xstore_point_of_service | 16.0.6, 17.0.4, 18.0.3, 19.0.2 | — |
| c-ares_project c-ares | v < 1.16.0 | 1.16.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.