Lucene search

[email protected]CVE-2020-8252

HistorySep 18, 2020 - 9:15 p.m.

CVE-2020-8252

2020-09-1821:15:13

CWE-120

[email protected]

web.nvd.nist.gov

211

cve

2020

8252

buffer overflow

libuv

node.js

implementation

realpath

nvd

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.2%

JSON

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Affected configurations

NVD

Node

nodejsnode.jsRange10.0.0–10.22.1lts

nodejsnode.jsRange12.0.0–12.18.4lts

nodejsnode.jsRange14.0.0–14.9.0-

Node

opensuseleapMatch15.2

Node

fedoraprojectfedoraMatch33

CPENameOperatorVersion
nodejs:node.jsnodejs node.jslt10.22.1
nodejs:node.jsnodejs node.jslt12.18.4
nodejs:node.jsnodejs node.jslt14.9.0

CPE	Name	Operator	Version
nodejs:node.js	nodejs node.js	lt	10.22.1
nodejs:node.js	nodejs node.js	lt	12.18.4
nodejs:node.js	nodejs node.js	lt	14.9.0

CNA Affected

[
  {
    "product": "https://github.com/nodejs/node",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in 10.22.1, 12.18.4, 14.9.0"
      }
    ]
  }
]