ByteOS Network

Vulnerability Details :

CVE-2020-8172

Summary

Assigner-hackerone

Assigner Org ID-36234546-b8fa-4601-9d6f-f4e334aa8ea1

Published At-08 Jun, 2020 | 13:08

Updated At-04 Aug, 2024 | 09:56

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:hackerone

Assigner Org ID:36234546-b8fa-4601-9d6f-f4e334aa8ea1

Published At:08 Jun, 2020 | 13:08

Updated At:04 Aug, 2024 | 09:56

▼CVE Numbering Authority (CNA)

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Affected Products

Vendor

n/a

Product

https://github.com/nodejs/node

Versions

Affected

12.18.0,14.4.0

Problem Types

Type	CWE ID	Description
text	N/A	Privilege Escalation (CAPEC-233)

Type: text

CWE ID: N/A

Description: Privilege Escalation (CAPEC-233)

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
https://hackerone.com/reports/811502	x_refsource_MISC
https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/	x_refsource_MISC
https://security.netapp.com/advisory/ntap-20200625-0002/	x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
https://security.gentoo.org/glsa/202101-07	vendor-advisory x_refsource_GENTOO
https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC

Hyperlink: https://www.oracle.com/security-alerts/cpujul2020.html

Resource:

x_refsource_MISC

Hyperlink: https://hackerone.com/reports/811502

Resource:

x_refsource_MISC

Hyperlink: https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/

Resource:

x_refsource_MISC

Hyperlink: https://security.netapp.com/advisory/ntap-20200625-0002/

Resource:

x_refsource_CONFIRM

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2020.html

Resource:

x_refsource_MISC

Hyperlink: https://security.gentoo.org/glsa/202101-07

Resource:

vendor-advisory

x_refsource_GENTOO

Hyperlink: https://www.oracle.com/security-alerts/cpujan2021.html

Resource:

x_refsource_MISC

Hyperlink: https://www.oracle.com//security-alerts/cpujul2021.html

Resource:

x_refsource_MISC

Hyperlink: https://www.oracle.com/security-alerts/cpuapr2022.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC x_transferred
https://hackerone.com/reports/811502	x_refsource_MISC x_transferred
https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/	x_refsource_MISC x_transferred
https://security.netapp.com/advisory/ntap-20200625-0002/	x_refsource_CONFIRM x_transferred
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC x_transferred
https://security.gentoo.org/glsa/202101-07	vendor-advisory x_refsource_GENTOO x_transferred
https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC x_transferred
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC x_transferred
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpujul2020.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://hackerone.com/reports/811502

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20200625-0002/

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2020.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://security.gentoo.org/glsa/202101-07

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpujan2021.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://www.oracle.com//security-alerts/cpujul2021.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://www.oracle.com/security-alerts/cpuapr2022.html

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:support@hackerone.com

Published At:08 Jun, 2020 | 14:15

Updated At:12 May, 2022 | 15:01

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.4	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary	2.0	5.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:N

Type: Primary

Version: 3.1

Base score: 7.4

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Type: Primary

Version: 2.0

Base score: 5.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:N

CPE Matches

Node.js (OpenJS Foundation)

>>node.js>>Versions from 12.0.0(inclusive) to 12.18.0(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 14.0.0(inclusive) to 14.4.0(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

Oracle Corporation

>>banking_extensibility_workbench>>14.3.0

cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*

Oracle Corporation

>>banking_extensibility_workbench>>14.4.0

cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:*

Oracle Corporation

>>blockchain_platform>>Versions before 21.1.2(exclusive)

cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*

Oracle Corporation

>>graalvm>>19.3.2

cpe:2.3:a:oracle:graalvm:19.3.2:*:*:*:enterprise:*:*:*

Oracle Corporation

>>graalvm>>20.1.0

cpe:2.3:a:oracle:graalvm:20.1.0:*:*:*:enterprise:*:*:*

Oracle Corporation

>>mysql_cluster>>Versions up to 7.3.30(inclusive)

cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*

Oracle Corporation

>>mysql_cluster>>Versions from 7.4.0(inclusive) to 7.4.29(inclusive)

cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*

Oracle Corporation

>>mysql_cluster>>Versions from 7.5.0(inclusive) to 7.5.19(inclusive)

cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*

Oracle Corporation

>>mysql_cluster>>Versions from 7.6.0(inclusive) to 7.6.15(inclusive)

cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*

Oracle Corporation

>>mysql_cluster>>Versions from 8.0.0(inclusive) to 8.0.21(inclusive)

cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-295	Primary	nvd@nist.gov

CWE ID: CWE-295

Type: Primary

Source: nvd@nist.gov