CVE-2020-8265 - nodejs: use-after-free in the TLS implementation

Back Back to CVE browser

HIGH

nodejs: use-after-free in the TLS implementation

Published Jan 6, 2021

8.1

HIGH

CVSS 3.1

EPSS 9.12%

Description

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.

Affected products

Vendor Node.js Product Node Default
unaffected
- Version
  10.0
  Status
  affected
  Constraints
  <10.23.1
- Version
  11.0
  Status
  affected
  Constraints
  <11.*
- Version
  12.0
  Status
  affected
  Constraints
  <12.20.1
- Version
  13.0
  Status
  affected
  Constraints
  <13.*
- Version
  14.0
  Status
  affected
  Constraints
  <14.15.4
- Version
  15.0
  Status
  affected
  Constraints
  <15.5.1
- Version
  4.0
  Status
  affected
  Constraints
  <4.*
- Version
  5.0
  Status
  affected
  Constraints
  <5.*
- Version
  6.0
  Status
  affected
  Constraints
  <6.*
- Version
  7.0
  Status
  affected
  Constraints
  <7.*
- Version
  8.0
  Status
  affected
  Constraints
  <8.*
- Version
  9.0
  Status
  affected
  Constraints
  <9.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Node.js

Node

unaffected

Version	Status	Constraints
10.0	affected	<10.23.1
11.0	affected	<11.*
12.0	affected	<12.20.1
13.0	affected	<13.*
14.0	affected	<14.15.4
15.0	affected	<15.5.1
4.0	affected	<4.*
5.0	affected	<5.*
6.0	affected	<6.*
7.0	affected	<7.*
8.0	affected	<8.*
9.0	affected	<9.*

Red Hat Enterprise Linux 8

nodejs:10-8030020210118191659.229f0a1c

Fixed · RHSA-2021:0548
Red Hat Enterprise Linux 8

nodejs:12-8030020210129141730.229f0a1c

Fixed · RHSA-2021:0549
Red Hat Enterprise Linux 8

nodejs:14-8030020210126165503.229f0a1c

Fixed · RHSA-2021:0551
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-nodejs10-nodejs-0:10.23.1-2.el7

Fixed · RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-nodejs12-nodejs-0:12.20.1-1.el7

Fixed · RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-nodejs12-nodejs-nodemon-0:2.0.3-1.el7

Fixed · RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-nodejs14-nodejs-0:14.15.4-2.el7

Fixed · RHSA-2021:0421
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-nodejs10-nodejs-0:10.23.1-2.el7

Fixed · RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-nodejs12-nodejs-0:12.20.1-1.el7

Fixed · RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-nodejs12-nodejs-nodemon-0:2.0.3-1.el7

Fixed · RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-nodejs14-nodejs-0:14.15.4-2.el7

Fixed · RHSA-2021:0421
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-nodejs10-nodejs-0:10.23.1-2.el7

Fixed · RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-nodejs12-nodejs-0:12.20.1-1.el7

Fixed · RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-nodejs12-nodejs-nodemon-0:2.0.3-1.el7

Fixed · RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-nodejs14-nodejs-0:14.15.4-2.el7

Fixed · RHSA-2021:0421
Red Hat Enterprise Linux 9

nodejs

Not affected
Red Hat Quay 3

quay

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	nodejs:10-8030020210118191659.229f0a1c	Fixed	RHSA-2021:0548
Red Hat Enterprise Linux 8	nodejs:12-8030020210129141730.229f0a1c	Fixed	RHSA-2021:0549
Red Hat Enterprise Linux 8	nodejs:14-8030020210126165503.229f0a1c	Fixed	RHSA-2021:0551
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-nodejs10-nodejs-0:10.23.1-2.el7	Fixed	RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-nodejs12-nodejs-0:12.20.1-1.el7	Fixed	RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-nodejs12-nodejs-nodemon-0:2.0.3-1.el7	Fixed	RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-nodejs14-nodejs-0:14.15.4-2.el7	Fixed	RHSA-2021:0421
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-nodejs10-nodejs-0:10.23.1-2.el7	Fixed	RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-nodejs12-nodejs-0:12.20.1-1.el7	Fixed	RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-nodejs12-nodejs-nodemon-0:2.0.3-1.el7	Fixed	RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-nodejs14-nodejs-0:14.15.4-2.el7	Fixed	RHSA-2021:0421
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-nodejs10-nodejs-0:10.23.1-2.el7	Fixed	RHSA-2021:0521
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-nodejs12-nodejs-0:12.20.1-1.el7	Fixed	RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-nodejs12-nodejs-nodemon-0:2.0.3-1.el7	Fixed	RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-nodejs14-nodejs-0:14.15.4-2.el7	Fixed	RHSA-2021:0421
Red Hat Enterprise Linux 9	nodejs	Not affected	n/a
Red Hat Quay 3	quay	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-416

Use After Free

References (14)

https://access.redhat.com/security/cve/CVE-2020-8265
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1912854
Issue Tracking
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
x_refsource_CONFIRMPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29134
Advisory
https://hackerone.com/reports/988103
x_refsource_MISCExploitIssue TrackingPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/
vendor-advisoryx_refsource_FEDORA
https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
x_refsource_MISCPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-8265
https://security.gentoo.org/glsa/202101-07
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://security.netapp.com/advisory/ntap-20210212-0003/
x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-8265
https://www.debian.org/security/2021/dsa-4826
vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2020-8265		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1912854		Issue Tracking
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf		x_refsource_CONFIRMPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29134		Advisory
https://hackerone.com/reports/988103		x_refsource_MISCExploitIssue TrackingPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/		vendor-advisoryx_refsource_FEDORA
https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/		x_refsource_MISCPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-8265
https://security.gentoo.org/glsa/202101-07		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://security.netapp.com/advisory/ntap-20210212-0003/		x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-8265
https://www.debian.org/security/2021/dsa-4826		vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html		x_refsource_MISCThird Party Advisory