Vulnerability · Published Nov 19, 2020 · Assigned by hackerone

CVE-2020-8277

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 54.2% (higher than 99.0% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)54.2%top 1.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	nodejs-nodemon	2.0.3-1.module_el8.4.0+2521+c668cc9f	ALSA-2021:0551
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2047+b07ac28e	ALSA-2020:5499
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2023+d2377ea3	ALSA-2020:5499
AlmaLinux:8	nodejs-packaging	17-3.module_el8.3.0+2023+d2377ea3	ALSA-2020:5499
AlmaLinux:8	nodejs-packaging	23-3.module_el8.5.0+254+b4526b16	ALSA-2021:0551
AlmaLinux:8	nodejs-packaging	23-3.module_el8.4.0+2522+3bd42762	ALSA-2021:0551
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2224+b07ac28e	ALSA-2020:5499
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2521+c668cc9f	ALSA-2020:5499
Alpine:v3.20	nodejs	14.15.1-r0	ALPINE-CVE-2020-8277
Alpine:v3.21	nodejs	14.15.1-r0	ALPINE-CVE-2020-8277
Alpine:v3.22	nodejs	14.15.1-r0	ALPINE-CVE-2020-8277
Alpine:v3.23	nodejs	14.15.1-r0	ALPINE-CVE-2020-8277
Alpine:v3.24	nodejs	14.15.1-r0	ALPINE-CVE-2020-8277
Alpine:v3.20	nodejs-current	15.3.0-r0	ALPINE-CVE-2020-8277
Alpine:v3.21	nodejs-current	15.3.0-r0	ALPINE-CVE-2020-8277
Alpine:v3.22	nodejs-current	15.3.0-r0	ALPINE-CVE-2020-8277
Alpine:v3.23	nodejs-current	15.3.0-r0	ALPINE-CVE-2020-8277
Alpine:v3.24	nodejs-current	15.3.0-r0	ALPINE-CVE-2020-8277
Debian:12	c-ares	1.17.1-1	DEBIAN-CVE-2020-8277
Debian:13	c-ares	1.17.1-1	DEBIAN-CVE-2020-8277
Debian:14	c-ares	1.17.1-1	DEBIAN-CVE-2020-8277
Rocky Linux:8	nodejs-nodemon	0:1.18.3-1.module+el8.3.0+101+f84c7154	RLSA-2020:5499
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.4.0+638+5344c6f7	RLSA-2021:0551
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.3.0+100+234774f7	RLSA-2021:0551
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.6.0+982+9fdca2d4	RLSA-2021:0551
Rocky Linux:8	nodejs-packaging	0:17-3.module+el8.3.0+101+f84c7154	RLSA-2020:5499
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.3.0+100+234774f7	RLSA-2021:0551
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.7.0+1071+4bdda2a8	RLSA-2021:0551
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.5.0+733+de4fee6c	RLSA-2021:0551

Affected products (as reported)

Vendor	Product	Versions
NodeJS	Node	4.0 – before 4.5.0 – before 5.6.0 – before 6.7.0 – before 7.8.0 – before 8.9.0 – before 9.11.0 – before 11.*12.0 – before 12.19.1

Weakness: CWE-400

References

https://hackerone.com/reports/1033107 x_refsource_MISC
https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/ x_refsource_CONFIRM
FEDORA-2020-7473744de1 vendor-advisory, x_refsource_FEDORA
FEDORA-2020-307e873389 vendor-advisory, x_refsource_FEDORA
GLSA-202012-11 vendor-advisory, x_refsource_GENTOO
GLSA-202101-07 vendor-advisory, x_refsource_GENTOO
https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
FEDORA-2021-afed2b904e vendor-advisory, x_refsource_FEDORA
FEDORA-2021-ee913722db vendor-advisory, x_refsource_FEDORA
https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC