High severity · published Nov 19, 2020
CVE-2020-8277
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1…
7.5
CVSS
54.2%
EPSS
No
On KEV
Description
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)54.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Blockchain Platform · Oracle
before 21.1.2 · source: NVD
CA
C-ares · C-ares Project
before 1.16.0 · source: NVD
FE
Fedora · Fedoraproject
32; 33 · source: NVD
GR
Graalvm · Oracle
19.3.4; 20.3.0 · source: NVD
JE
JD Edwards Enterpriseone Tools · Oracle
before 9.2.6.0 · source: NVD
MC
Mysql Cluster · Oracle
through 8.0.23 · source: NVD
NO
Node.js · Nodejs
12.16.3 before 12.19.1; 14.13.0 before 14.15.1; 15.0.0 before 15.2.1 · source: NVD
RX
Retail Xstore Point OF Service · Oracle
16.0.6; 17.0.4; 18.0.3; 19.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8277
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8277
Permissions Required
https://hackerone.com/reports/1033107
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/
Patch
https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/
More from C-ares
9.8
CVE-2016-5180
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly…
8.6
CVE-2022-4904
A flaw was found in the c-ares package
7.5
CVE-2023-32067
c-ares is an asynchronous resolver library
7.5
CVE-2017-1000381
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS…
6.5
CVE-2023-31147
c-ares is an asynchronous resolver library