CVE-2020-8277
19.11.2020, 01:15
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.Enginsight
| Vendor | Product | Version |
|---|---|---|
| nodejs | node.js | 12.16.3 ≤ 𝑥 < 12.19.1 |
| nodejs | node.js | 14.13.0 ≤ 𝑥 < 14.15.1 |
| nodejs | node.js | 15.0.0 ≤ 𝑥 < 15.2.1 |
| oracle | blockchain_platform | 𝑥 < 21.1.2 |
| oracle | graalvm | 19.3.4 |
| oracle | graalvm | 20.3.0 |
| oracle | jd_edwards_enterpriseone_tools | 𝑥 < 9.2.6.0 |
| oracle | mysql_cluster | 𝑥 ≤ 8.0.23 |
| oracle | retail_xstore_point_of_service | 16.0.6 |
| oracle | retail_xstore_point_of_service | 17.0.4 |
| oracle | retail_xstore_point_of_service | 18.0.3 |
| oracle | retail_xstore_point_of_service | 19.0.2 |
| c-ares_project | c-ares | 𝑥 < 1.16.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References