Vulnerable Library - nodev12.18.2

Node.js JavaScript runtime ✨🐢🚀✨

Library home page: https://github.com/nodejs/node.git

Found in HEAD commit: 00fdb00d5bdbaea4fec4642989374d82cbdb1a3c

Found in base branch: master

Vulnerable Source Files (3)

node/deps/cares/src/ares_parse_aaaa_reply.c
node/deps/cares/src/ares_parse_a_reply.c
node/deps/cares/src/ares_parse_a_reply.c

Vulnerability Details

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

Publish Date: 2020-11-19

URL: CVE-2020-8277

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/

Release Date: 2020-11-19

Fix Resolution: v12.19.1, v14.15.1, v15.2.1