CVE-2020-8265 log

Severity High
Remote No
Type Arbitrary code execution
The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1.
Group Package Affected Fixed Severity Status Ticket
AVG-1403 nodejs-lts-dubnium 10.23.0-2 10.23.1-1 High Fixed
AVG-1402 nodejs-lts-erbium 12.20.0-2 12.20.1-1 High Fixed
AVG-1401 nodejs-lts-fermium 14.15.3-2 14.15.4-1 High Fixed
AVG-1400 nodejs 15.5.0-1 15.5.1-1 High Fixed
Date Advisory Group Package Severity Type
12 Jan 2021 ASA-202101-16 AVG-1400 nodejs High multiple issues
12 Jan 2021 ASA-202101-15 AVG-1401 nodejs-lts-fermium High multiple issues
12 Jan 2021 ASA-202101-14 AVG-1402 nodejs-lts-erbium High multiple issues
12 Jan 2021 ASA-202101-13 AVG-1403 nodejs-lts-dubnium High multiple issues