NetSight
IP …
high8.1

CVE-2020-8265

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation.

Impact

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.

Affected products

VendorProductAffected versions
NodejsNode.Js
from 10.0.0 before 10.23.1
from 12.0.0 before 12.20.1
from 14.0.0 before 14.15.4
from 15.0.0 before 15.5.1
DebianDebian Linux
Version 10.0
FedoraprojectFedora
Versions 32, 33
OracleGraalvm
Versions 19.3.4, 20.3.0
SiemensSinec Infrastructure Network Services
before 1.0.1.1

Weakness classification

CWE-416

References