CVE-2020-8265

06.01.2021, 21:15

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
hackerone	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 70%

Vendor	Product	Version
nodejs	node.js	10.0.0 ≤ 𝑥 < 10.23.1
nodejs	node.js	12.0.0 ≤ 𝑥 < 12.20.1
nodejs	node.js	14.0.0 ≤ 𝑥 < 14.15.4
nodejs	node.js	15.0.0 ≤ 𝑥 < 15.5.1
debian	debian_linux	10.0
oracle	graalvm	19.3.4
oracle	graalvm	20.3.0
siemens	sinec_infrastructure_network_services	𝑥 < 1.0.1.1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

nodejs

bullseye	12.22.12~dfsg-1~deb11u4 fixed
stretch	ignored
bullseye (security)	12.22.12~dfsg-1~deb11u5 fixed
bookworm	18.19.0+dfsg-6~deb12u2 fixed
bookworm (security)	18.19.0+dfsg-6~deb12u1 fixed
sid	20.17.0+dfsg-2 fixed
trixie	20.17.0+dfsg-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

nodejs

mantic	not-affected
lunar	not-affected
kinetic	ignored
jammy	not-affected
impish	ignored
hirsute	ignored
groovy	ignored
focal	Fixed 10.19.0~dfsg-3ubuntu1.1 released
bionic	Fixed 8.10.0~dfsg-2ubuntu0.4+esm2 released
xenial	Fixed 4.2.6~dfsg-1ubuntu4.2+esm2 released
trusty	not-affected