Vulnerability · Published Sep 18, 2020 · Assigned by hackerone

CVE-2020-8252

High 7.8

In plain English

A high-severity buffer overflow in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High

Exploit odds (30 days)0.7%top 46.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2023+d2377ea3	ALSA-2020:4272
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2047+b07ac28e	ALSA-2020:4272
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2023+d2377ea3	ALSA-2021:0548
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2047+b07ac28e	ALSA-2021:0548
AlmaLinux:8	nodejs-packaging	17-3.module_el8.3.0+2023+d2377ea3	ALSA-2020:4272
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2521+c668cc9f	ALSA-2021:0548
AlmaLinux:8	nodejs-packaging	17-3.module_el8.3.0+2023+d2377ea3	ALSA-2021:0548
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2224+b07ac28e	ALSA-2021:0548
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2224+b07ac28e	ALSA-2020:4272
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2521+c668cc9f	ALSA-2020:4272
Alpine:v3.20	libuv	1.39.0-r0	ALPINE-CVE-2020-8252
Alpine:v3.21	libuv	1.39.0-r0	ALPINE-CVE-2020-8252
Alpine:v3.22	libuv	1.39.0-r0	ALPINE-CVE-2020-8252
Alpine:v3.23	libuv	1.39.0-r0	ALPINE-CVE-2020-8252
Alpine:v3.24	libuv	1.39.0-r0	ALPINE-CVE-2020-8252
Alpine:v3.20	nodejs	12.18.4-r0	ALPINE-CVE-2020-8252
Alpine:v3.21	nodejs	12.18.4-r0	ALPINE-CVE-2020-8252
Alpine:v3.22	nodejs	12.18.4-r0	ALPINE-CVE-2020-8252
Alpine:v3.23	nodejs	12.18.4-r0	ALPINE-CVE-2020-8252
Alpine:v3.24	nodejs	12.18.4-r0	ALPINE-CVE-2020-8252
Debian:12	libuv1	1.39.0-1	DEBIAN-CVE-2020-8252
Debian:13	libuv1	1.39.0-1	DEBIAN-CVE-2020-8252
Debian:14	libuv1	1.39.0-1	DEBIAN-CVE-2020-8252
Rocky Linux:8	nodejs-nodemon	0:1.18.3-1.module+el8.3.0+101+f84c7154	RLSA-2021:0548
Rocky Linux:8	nodejs-nodemon	0:1.18.3-1.module+el8.3.0+101+f84c7154	RLSA-2020:4272
Rocky Linux:8	nodejs-packaging	0:17-3.module+el8.3.0+101+f84c7154	RLSA-2021:0548
Rocky Linux:8	nodejs-packaging	0:17-3.module+el8.3.0+101+f84c7154	RLSA-2020:4272

Affected products (as reported)

Vendor	Product	Versions
NodeJS	Node	4.0 – before 4.5.0 – before 5.6.0 – before 6.7.0 – before 7.8.0 – before 8.9.0 – before 9.10.0 – before 10.22.111.0 – before 11.*

Weakness: CWE-120

References

https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/ x_refsource_MISC
https://hackerone.com/reports/965914 x_refsource_MISC
GLSA-202009-15 vendor-advisory, x_refsource_GENTOO
USN-4548-1 vendor-advisory, x_refsource_UBUNTU
openSUSE-SU-2020:1616 vendor-advisory, x_refsource_SUSE
https://security.netapp.com/advisory/ntap-20201009-0004/ x_refsource_CONFIRM
openSUSE-SU-2020:1660 vendor-advisory, x_refsource_SUSE
FEDORA-2020-43d5a372fc vendor-advisory, x_refsource_FEDORA