CVE-2020-8172
Fixed in a distro release EPSS 6%
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
Products: nodejs node.js, oracle banking_extensibility_workbench, oracle blockchain_platform, oracle graalvm, Oracle MySQL Cluster
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2047+b07ac28e |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| Alpine 3.11 | nodejs | 12.20.1-r0 |
| Alpine 3.12 | nodejs | 12.18.3-r0 |
| Alpine 3.13 | nodejs | 12.18.0-r0 |
| Alpine 3.14 | nodejs | 12.18.0-r0 |
| Alpine 3.15 | nodejs | 12.18.0-r0 |
| Alpine 3.16 | nodejs | 12.18.0-r0 |
| Alpine 3.17 | nodejs | 12.18.0-r0 |
| Alpine 3.18 | nodejs | 12.18.0-r0 |
| Alpine 3.19 | nodejs | 12.18.0-r0 |
| Alpine 3.20 | nodejs | 12.18.0-r0 |
| Alpine 3.21 | nodejs | 12.18.0-r0 |
| Alpine 3.22 | nodejs | 12.18.0-r0 |
| Alpine 3.23 | nodejs | 12.18.0-r0 |
| Alpine 3.24 | nodejs | 12.18.0-r0 |
| Red Hat Enterprise Linux 8 | nodejs | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:12.18.2-1.module+el8.2.0+7233+61d664c1 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat Enterprise Linux 8 | npm | 1:6.14.5-1.12.18.2.1.module+el8.2.0+7233+61d664c1 |
| Red Hat rhel eus 8.1 | nodejs | 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5 |
| Red Hat rhel eus 8.1 | nodejs-debuginfo | 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5 |
| Red Hat rhel eus 8.1 | nodejs-debugsource | 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5 |
| Red Hat rhel eus 8.1 | nodejs-devel | 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5 |
| Red Hat rhel eus 8.1 | nodejs-docs | 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5 |
| Red Hat rhel eus 8.1 | nodejs-full-i18n | 1:12.18.2-1.module+el8.1.0+7232+f8b5ede5 |
| Red Hat rhel eus 8.1 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat rhel eus 8.1 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat rhel eus 8.1 | npm | 1:6.14.5-1.12.18.2.1.module+el8.1.0+7232+f8b5ede5 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs | 0:12.18.2-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-debuginfo | 0:12.18.2-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-devel | 0:12.18.2-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-docs | 0:12.18.2-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-npm | 0:6.14.5-12.18.2.1.el7 |
| Rocky Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.3.0+101+f84c7154 |
| Rocky Linux 8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs12 | 12.18.0-1.14.1 |
| openSUSE Tumbleweed | nodejs14 | 14.17.5-1.2 |