Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-8277

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

Published

2020-11-19T01:15:12.763

Last Modified

2024-11-21T05:38:38.383

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-400
  • Type: Primary
    CWE-400
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application nodejs node.js < 12.19.1 Yes
Application nodejs node.js < 14.15.1 Yes
Application nodejs node.js < 15.2.1 Yes
Operating System fedoraproject fedora 32 Yes
Operating System fedoraproject fedora 33 Yes
Application oracle blockchain_platform < 21.1.2 Yes
Application oracle graalvm 19.3.4 Yes
Application oracle graalvm 20.3.0 Yes
Application oracle jd_edwards_enterpriseone_tools < 9.2.6.0 Yes
Application oracle mysql_cluster ≤ 8.0.23 Yes
Application oracle retail_xstore_point_of_service 16.0.6 Yes
Application oracle retail_xstore_point_of_service 17.0.4 Yes
Application oracle retail_xstore_point_of_service 18.0.3 Yes
Application oracle retail_xstore_point_of_service 19.0.2 Yes
Application c-ares_project c-ares < 1.16.0 Yes
References