CVE-2020-8277

Published: Nov 19, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

Affected (15)

Products: Nodejs: Node.js · Fedoraproject: Fedora · Oracle: Blockchain Platform, Graalvm, Jd Edwards Enterpriseone Tools, Mysql Cluster, Retail Xstore Point Of Service · +1 more

Show all products

Nodejs: Node.js · Fedoraproject: Fedora · Oracle: Blockchain Platform, Graalvm, Jd Edwards Enterpriseone Tools, Mysql Cluster, Retail Xstore Point Of Service · C Ares Project: C Ares

1 product

1 product

5 products

Blockchain Platform

Jd Edwards Enterpriseone Tools

Retail Xstore Point Of Service

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 15.0.0 to 15.2.1
Nodejs Node.js	From 12.16.3 to 12.19.1
Nodejs Node.js	From 14.13.0 to 14.15.1

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration C

9 vulnerable

Vulnerable Software	Affected Versions
Oracle Blockchain Platform	Before 21.1.2
Oracle Graalvm	Version 19.3.4
Oracle Graalvm	Version 20.3.0
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.6.0
Oracle Mysql Cluster	Up to 8.0.23
Oracle Retail Xstore Point Of Service	Version 16.0.6
Oracle Retail Xstore Point Of Service	Version 17.0.4
Oracle Retail Xstore Point Of Service	Version 18.0.3
Oracle Retail Xstore Point Of Service	Version 19.0.2

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
C Ares Project C Ares	Before 1.16.0

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (26)

https://hackerone.com/reports/1033107

Source: support@hackerone.com

Permissions RequiredThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/

Source: support@hackerone.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/

Source: support@hackerone.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/

Source: support@hackerone.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/

Source: support@hackerone.com

https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/

Source: support@hackerone.com

PatchVendor Advisory

https://security.gentoo.org/glsa/202012-11

Source: support@hackerone.com

Third Party Advisory

https://security.gentoo.org/glsa/202101-07

Source: support@hackerone.com

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://hackerone.com/reports/1033107

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions RequiredThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/

Source: af854a3a-2127-422b-91ae-364da2661108

https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://security.gentoo.org/glsa/202012-11

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.gentoo.org/glsa/202101-07

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.