CVE-2020-8252
Fixed in a distro release EPSS <1%
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| AlmaLinux:8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2047+b07ac28e |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| Alpine:v3.11 | nodejs | 12.20.1-r0 |
| Alpine:v3.12 | libuv | 1.38.1-r0 |
| Alpine:v3.12 | nodejs | 12.18.4-r0 |
| Alpine:v3.13 | libuv | 1.39.0-r0 |
| Alpine:v3.13 | nodejs | 12.18.4-r0 |
| Alpine:v3.14 | libuv | 1.39.0-r0 |
| Alpine:v3.14 | nodejs | 12.18.4-r0 |
| Alpine:v3.15 | libuv | 1.39.0-r0 |
| Alpine:v3.15 | nodejs | 12.18.4-r0 |
| Alpine:v3.16 | libuv | 1.39.0-r0 |
| Alpine:v3.16 | nodejs | 12.18.4-r0 |
| Alpine:v3.17 | libuv | 1.39.0-r0 |
| Alpine:v3.17 | nodejs | 12.18.4-r0 |
| Alpine:v3.18 | libuv | 1.39.0-r0 |
| Alpine:v3.18 | nodejs | 12.18.4-r0 |
| Alpine:v3.19 | libuv | 1.39.0-r0 |
| Alpine:v3.19 | nodejs | 12.18.4-r0 |
| Alpine:v3.20 | libuv | 1.39.0-r0 |
| Alpine:v3.20 | nodejs | 12.18.4-r0 |
| Alpine:v3.21 | libuv | 1.39.0-r0 |
| Alpine:v3.21 | nodejs | 12.18.4-r0 |
| Alpine:v3.22 | libuv | 1.39.0-r0 |
| Alpine:v3.22 | nodejs | 12.18.4-r0 |
| Alpine:v3.23 | libuv | 1.39.0-r0 |
| Alpine:v3.23 | nodejs | 12.18.4-r0 |
| Alpine:v3.24 | libuv | 1.39.0-r0 |
| Alpine:v3.24 | nodejs | 12.18.4-r0 |
| Debian:12 | libuv1 | 1.39.0-1 |
| Debian:13 | libuv1 | 1.39.0-1 |
| Debian:14 | libuv1 | 1.39.0-1 |
| Red Hat:enterprise_linux:8 | nodejs | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat:enterprise_linux:8 | nodejs | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat:enterprise_linux:8 | nodejs-debuginfo | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat:enterprise_linux:8 | nodejs-debuginfo | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat:enterprise_linux:8 | nodejs-debugsource | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat:enterprise_linux:8 | nodejs-debugsource | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat:enterprise_linux:8 | nodejs-devel | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat:enterprise_linux:8 | nodejs-devel | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat:enterprise_linux:8 | nodejs-docs | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat:enterprise_linux:8 | nodejs-docs | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat:enterprise_linux:8 | nodejs-full-i18n | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat:enterprise_linux:8 | nodejs-full-i18n | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat:enterprise_linux:8 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat:enterprise_linux:8 | nodejs-nodemon | 0:1.18.3-1.module+el8+2632+6c5111ed |
| Red Hat:enterprise_linux:8 | nodejs-packaging | 0:17-3.module+el8+2873+aa7dfd9a |
| Red Hat:enterprise_linux:8 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat:enterprise_linux:8 | npm | 1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e |
| Red Hat:enterprise_linux:8 | npm | 1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97 |
| Red Hat:rhel_eus:8.1 | nodejs | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat:rhel_eus:8.1 | nodejs-debuginfo | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat:rhel_eus:8.1 | nodejs-debugsource | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat:rhel_eus:8.1 | nodejs-devel | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat:rhel_eus:8.1 | nodejs-docs | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat:rhel_eus:8.1 | nodejs-full-i18n | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat:rhel_eus:8.1 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat:rhel_eus:8.1 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat:rhel_eus:8.1 | npm | 1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500 |
| Red Hat:rhel_software_collections:3 | rh-nodejs10-nodejs | 0:10.23.1-2.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs10-nodejs-debuginfo | 0:10.23.1-2.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs10-nodejs-devel | 0:10.23.1-2.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs10-nodejs-docs | 0:10.23.1-2.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs10-npm | 0:6.14.10-10.23.1.2.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs12-nodejs | 0:12.18.4-3.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs12-nodejs-debuginfo | 0:12.18.4-3.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs12-nodejs-devel | 0:12.18.4-3.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs12-nodejs-docs | 0:12.18.4-3.el7 |
| Red Hat:rhel_software_collections:3 | rh-nodejs12-npm | 0:6.14.6-12.18.4.3.el7 |
| Rocky Linux:8 | nodejs-nodemon | 0:1.18.3-1.module+el8.3.0+101+f84c7154 |
| Rocky Linux:8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | nodejs10 | 10.22.1-1.27.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | nodejs10 | 10.22.1-1.27.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 12 | nodejs10 | 10.22.1-1.30.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 12 | nodejs12 | 12.18.4-1.20.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP1 | nodejs10 | 10.22.1-1.27.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP2 | nodejs10 | 10.22.1-1.27.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP2 | nodejs12 | 12.18.4-4.6.1 |
| SUSE:Linux Enterprise Server 15-LTSS | nodejs10 | 10.22.1-1.27.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | nodejs10 | 10.22.1-1.27.1 |
| Ubuntu:20.04:LTS | libuv1 | 1.34.2-1ubuntu1.1 |
| openSUSE:Leap 15.2 | nodejs10 | 10.22.1-lp152.2.6.1 |
| openSUSE:Leap 15.2 | nodejs12 | 12.18.4-lp152.3.6.1 |