Use-after-free in Node.js - CVE-2020-8265

Vulnerability identifier: #VU49254

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8265

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a DoS attack..

The vulnerability exists due to a use-after-free error in TLSWrap within the TLS implementation. A remote attacker can send specially crafted data to the service and perform a denial of service (DoS) attack.

Node.js
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Ubuntu
openEuler
Fedora
MicroSCADA X SYS600
MicroSCADA Pro SYS600
e-mesh EMS
Gateway Station (GWS)
FACTS Control Platform (FCP)
SINEC INS
IBM Netcool Agile Service Manager
IBM Cloud Transformation Advisor
IBM Security Guardium Insights
EasyApache
IBM Watson Assistant for IBM Cloud Pak for Data
nodejs (Alpine package)
nodejs-current (Alpine package)
nodejs (Ubuntu package)
nodejs-dev (Ubuntu package)
nodejs-legacy (Ubuntu package)
libnode64 (Ubuntu package)
libnode-dev (Ubuntu package)
nodejs (Debian package)
rh-nodejs12-nodejs-nodemon (Red Hat package)
v8-devel
npm
nodejs
nodejs-libs
nodejs-docs
nodejs-debugsource
nodejs-full-i18n
nodejs-debuginfo
nodejs-devel
rh-nodejs10-nodejs (Red Hat package)
rh-nodejs12-nodejs (Red Hat package)
rh-nodejs14-nodejs (Red Hat package)
IBM DataPower Gateway

Install updates from vendor's website.

Node.js - addressed in versions 10.23.1, 12.20.1, 14.15.4, 15.5.1
MicroSCADA X SYS600 - update to 10.3
MicroSCADA Pro SYS600 - update to 10.3
e-mesh EMS - update to 1.0.1
IBM Netcool Agile Service Manager - update to 1.1.13
IBM Security Guardium Insights - update to 3.0
EasyApache - update to 4 20201-3-3
nodejs (Alpine package) - update to 14.15.4-r0
nodejs-current (Alpine package) - update to 15.5.1-r0
nodejs (Ubuntu package) - addressed in versions 4.2.6~dfsg-1ubuntu4.2+esm2, 8.10.0~dfsg-2ubuntu0.4+esm2, 10.19.0~dfsg-3ubuntu1.1
nodejs-dev (Ubuntu package) - addressed in versions 4.2.6~dfsg-1ubuntu4.2+esm2, 8.10.0~dfsg-2ubuntu0.4+esm2
nodejs-legacy (Ubuntu package) - update to 4.2.6~dfsg-1ubuntu4.2+esm2
libnode64 (Ubuntu package) - update to 10.19.0~dfsg-3ubuntu1.1
libnode-dev (Ubuntu package) - update to 10.19.0~dfsg-3ubuntu1.1
nodejs (Debian package) - update to 10.23.1~dfsg-1~deb10u1
rh-nodejs12-nodejs-nodemon (Red Hat package) - update to 2.0.3-1.el7
v8-devel - update to 6.8.275.32-1.10.21.0.4.oe1
npm - update to 6.14.4-1.10.21.0.4.oe1
nodejs - addressed in versions 10-3220210105182003.43bbeeef, 10-3320210105182003.601d93de, 12-3220210105181808.43bbeeef, 12-3320210105181808.601d93de, 12.20.1-1.fc32, 14-3220210105180508.43bbeeef, 14-3320210105180508.601d93de, 14.15.4-1.fc33
nodejs-libs - update to 10.21.0-4
nodejs-docs - update to 10.21.0-4
nodejs-debugsource - update to 10.21.0-4
nodejs-full-i18n - update to 10.21.0-4
nodejs-debuginfo - update to 10.21.0-4
nodejs-devel - update to 10.21.0-4
nodejs - update to 10.21.0-4
rh-nodejs10-nodejs (Red Hat package) - update to 10.23.1-2.el7
rh-nodejs12-nodejs (Red Hat package) - update to 12.20.1-1.el7
rh-nodejs14-nodejs (Red Hat package) - update to 14.15.4-2.el7
SINEC INS - update to 1.0.1.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.0.0
IBM DataPower Gateway - addressed in versions 10.0.1.4, 10.0.3.0, 2018.4.1.17

• https://nodejs.org/en/blog/release/v10.23.1/
• https://nodejs.org/en/blog/release/v12.20.1/
• https://nodejs.org/en/blog/release/v14.15.4/
• https://nodejs.org/en/blog/release/v15.5.1/

• Multiple vulnerabilities in Node.js
• Use-after-free in nodejs (Alpine package)
• Use-after-free in nodejs-current (Alpine package)
• Debian update for nodejs
• Gentoo update for NodeJS
• Arch Linux update for nodejs
• Arch Linux update for nodejs-lts-dubnium
• Arch Linux update for nodejs-lts-erbium
• Arch Linux update for nodejs-lts-fermium
• EasyApache 4 update for NodeJS
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple vulnerabilities in Hitachi Energy e-mesh EMS
• Multiple vulnerabilities in Hitachi Energy MicroSCADA Pro/X SYS600
• Multiple Vulnerabilities in IBM Netcool Agile Service Manager
• Multiple vulnerabilities in Hitachi Energy FACTS Control Platform (FCP)
• Multiple vulnerabilities in Hitachi Energy Gateway Station (GWS)
• Multiple vulnerabilities in IBM DataPower Gateway
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Ubuntu update for nodejs
• openEuler update for nodejs
• Red Hat Software Collections update for rh-nodejs14-nodejs
• Red Hat Software Collections update for rh-nodejs12-nodejs
• Red Hat Software Collections update for rh-nodejs10-nodejs
• Red Hat Enterprise Linux 8 update for the nodejs:10 module
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Fedora 32 Modular update for nodejs
• Fedora 33 Modular update for nodejs
• Fedora 32 update for nodejs
• Fedora 33 Modular update for nodejs
• Fedora 32 Modular update for nodejs
• Fedora 32 Modular update for nodejs
• Fedora 33 Modular update for nodejs
• Fedora 33 update for nodejs
• Multiple vulnerabilities in IBM Security Guardium Insights