CVE Feed

    Dashboard / CVE / CVE-2020-8277

    CVE-2020-8277

    A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

    Published:Nov 12, 2020
    Last Modified:Apr 30, 2025
    EPS:Nov 19, 2020
    EPSS Score:0.59168
    CVSS Score:7.5

    Affected Products

    Vendor
    C-ares Project
    Product
    C-ares
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Nodejs
    Product
    Node.js
    Vendor
    Oracle
    Product
    Blockchain Platform
    Vendor
    Oracle
    Product
    Graalvm
    Vendor
    Oracle
    Product
    Jd Edwards Enterpriseone Tools
    Vendor
    Oracle
    Product
    Mysql Cluster
    Vendor
    Oracle
    Product
    Retail Xstore Point Of Service
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Software Collections

    Exploits

    https://github.com/AndrewIjano/CVE-2020-8277https://github.com/masahiro331/CVE-2020-8277

    Related CVEs

    CVE-2023-31147 (CVSS 5.9) — c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses r…
    CVE-2023-31124 (CVSS 3.7) — c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, …
    CVE-2023-32067 (CVSS 7.5) — c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver se…
    CVE-2023-31130 (CVSS 4.1) — c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certa…
    CVE-2022-4904 (CVSS 8.6) — A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the inpu…
    CVE-2021-3672 (CVSS 5.6) — A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Doma…
    CVE-2017-1000381 (CVSS 7.5) — The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered …
    CVE-2016-5180 (CVSS 9.8) — Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attacke…

    References

    https://hackerone.com/reports/1033107
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/
    https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/
    https://security.gentoo.org/glsa/202012-11
    https://security.gentoo.org/glsa/202101-07
    https://www.oracle.com//security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://hackerone.com/reports/1033107
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEIV4CH6KNVZK63Y6EKVN2XDW7IHSJBJ/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXLJY4764LYVJPC7NCDLE2UMQ3QC5OI2/
    https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/
    https://security.gentoo.org/glsa/202012-11
    https://security.gentoo.org/glsa/202101-07
    https://www.oracle.com//security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpuapr2022.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpuoct2021.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High