Use-after-free in Node.js - CVE-2020-8265

Vulnerability identifier: #VU49254

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8265

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a DoS attack..

The vulnerability exists due to a use-after-free error in TLSWrap within the TLS implementation. A remote attacker can send specially crafted data to the service and perform a denial of service (DoS) attack.

Node.js
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Ubuntu
openEuler
Fedora
MicroSCADA Pro SYS600
MicroSCADA X SYS600
Gateway Station (GWS)
e-mesh EMS
FACTS Control Platform (FCP)
SINEC INS
IBM Netcool Agile Service Manager
IBM Cloud Transformation Advisor
IBM Security Guardium Insights
EasyApache
IBM Watson Assistant for IBM Cloud Pak for Data
nodejs (Alpine package)
nodejs (Debian package)
nodejs-current (Alpine package)
nodejs-legacy (Ubuntu package)
nodejs-dev (Ubuntu package)
nodejs (Ubuntu package)
rh-nodejs12-nodejs-nodemon (Red Hat package)
v8-devel
npm
libnode64 (Ubuntu package)
libnode-dev (Ubuntu package)
nodejs-libs
nodejs-docs
nodejs-debugsource
nodejs-full-i18n
nodejs-devel
nodejs
nodejs-debuginfo
rh-nodejs10-nodejs (Red Hat package)
rh-nodejs12-nodejs (Red Hat package)
rh-nodejs14-nodejs (Red Hat package)
IBM DataPower Gateway

Install updates from vendor's website.

Node.js - addressed in versions 10.23.1, 12.20.1, 14.15.4, 15.5.1
MicroSCADA Pro SYS600 - update to 10.3
MicroSCADA X SYS600 - update to 10.3
e-mesh EMS - update to 1.0.1
IBM Netcool Agile Service Manager - update to 1.1.13
IBM Security Guardium Insights - update to 3.0
EasyApache - update to 4 20201-3-3
nodejs (Alpine package) - update to 14.15.4-r0
nodejs (Debian package) - update to 10.23.1~dfsg-1~deb10u1
nodejs-current (Alpine package) - update to 15.5.1-r0
nodejs-legacy (Ubuntu package) - update to Ubuntu Pro
nodejs-dev (Ubuntu package) - update to Ubuntu Pro
nodejs (Ubuntu package) - addressed in versions Ubuntu Pro, 10.19.0~dfsg-3ubuntu1.1
SINEC INS - update to 1.0.1.1
rh-nodejs12-nodejs-nodemon (Red Hat package) - update to 2.0.3-1.el7
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.0.0
v8-devel - update to 6.8.275.32-1.10.21.0.4.oe1
npm - update to 6.14.4-1.10.21.0.4.oe1
IBM DataPower Gateway - addressed in versions 10.0.1.4, 10.0.3.0, 2018.4.1.17
libnode64 (Ubuntu package) - update to 10.19.0~dfsg-3ubuntu1.1
libnode-dev (Ubuntu package) - update to 10.19.0~dfsg-3ubuntu1.1
nodejs-libs - update to 10.21.0-4
nodejs-docs - update to 10.21.0-4
nodejs-debugsource - update to 10.21.0-4
nodejs-full-i18n - update to 10.21.0-4
nodejs-devel - update to 10.21.0-4
nodejs - update to 10.21.0-4
nodejs-debuginfo - update to 10.21.0-4
rh-nodejs10-nodejs (Red Hat package) - update to 10.23.1-2.el7
nodejs - addressed in versions 10-3220210105182003.43bbeeef, 10-3320210105182003.601d93de, 12.20.1-1.fc32, 12-3220210105181808.43bbeeef, 12-3320210105181808.601d93de, 14.15.4-1.fc33, 14-3220210105180508.43bbeeef, 14-3320210105180508.601d93de
rh-nodejs12-nodejs (Red Hat package) - update to 12.20.1-1.el7
rh-nodejs14-nodejs (Red Hat package) - update to 14.15.4-2.el7

• https://nodejs.org/en/blog/release/v10.23.1/
• https://nodejs.org/en/blog/release/v12.20.1/
• https://nodejs.org/en/blog/release/v14.15.4/
• https://nodejs.org/en/blog/release/v15.5.1/

• Multiple vulnerabilities in Node.js
• Use-after-free in nodejs (Alpine package)
• Use-after-free in nodejs-current (Alpine package)
• Debian update for nodejs
• Gentoo update for NodeJS
• Arch Linux update for nodejs
• Arch Linux update for nodejs-lts-dubnium
• Arch Linux update for nodejs-lts-erbium
• Arch Linux update for nodejs-lts-fermium
• EasyApache 4 update for NodeJS
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple vulnerabilities in Hitachi Energy e-mesh EMS
• Multiple vulnerabilities in Hitachi Energy MicroSCADA Pro/X SYS600
• Multiple Vulnerabilities in IBM Netcool Agile Service Manager
• Multiple vulnerabilities in Hitachi Energy FACTS Control Platform (FCP)
• Multiple vulnerabilities in Hitachi Energy Gateway Station (GWS)
• Multiple vulnerabilities in IBM DataPower Gateway
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Ubuntu update for nodejs
• openEuler update for nodejs
• Red Hat Software Collections update for rh-nodejs14-nodejs
• Red Hat Software Collections update for rh-nodejs12-nodejs
• Red Hat Software Collections update for rh-nodejs10-nodejs
• Red Hat Enterprise Linux 8 update for the nodejs:10 module
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Fedora 32 Modular update for nodejs
• Fedora 33 Modular update for nodejs
• Fedora 32 update for nodejs
• Fedora 33 Modular update for nodejs
• Fedora 32 Modular update for nodejs
• Fedora 32 Modular update for nodejs
• Fedora 33 Modular update for nodejs
• Fedora 33 update for nodejs
• Multiple vulnerabilities in IBM Security Guardium Insights