Vulnerabilities > CVE-2020-8265 - Use After Free vulnerability in multiple products

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.

Vulnerable Configurations

Part	Description	Count
Application	Nodejs Nodejs Node.Js 15.0.0 Nodejs Node.Js 15.0.1 Nodejs Node.Js 15.1.0 Nodejs Node.Js 15.2.0 Nodejs Node.Js 15.2.1 Nodejs Node.Js 15.3.0 Nodejs Node.Js 15.4.0 Nodejs Node.Js 15.5.0 Nodejs Node.Js 14.0.0 Nodejs Node.Js 14.1.0 Nodejs Node.Js 14.2.0 Nodejs Node.Js 14.3.0 Nodejs Node.Js 14.4.0 Nodejs Node.Js 14.5.0 Nodejs Node.Js 14.6.0 Nodejs Node.Js 14.7.0 Nodejs Node.Js 14.8.0 Nodejs Node.Js 14.9.0 Nodejs Node.Js 14.10.0 Nodejs Node.Js 14.10.1 Nodejs Node.Js 14.11.0 Nodejs Node.Js 14.12.0 Nodejs Node.Js 14.13.0 Nodejs Node.Js 14.13.1 Nodejs Node.Js 14.14.0 Nodejs Node.Js 14.15.0 Nodejs Node.Js 14.15.1 Nodejs Node.Js 14.15.2 Nodejs Node.Js 14.15.3 Nodejs Node.Js 12.0.0 Nodejs Node.Js 12.1.0 Nodejs Node.Js 12.2.0 Nodejs Node.Js 12.3.0 Nodejs Node.Js 12.3.1 Nodejs Node.Js 12.4.0 Nodejs Node.Js 12.5.0 Nodejs Node.Js 12.6.0 Nodejs Node.Js 12.7.0 Nodejs Node.Js 12.8.0 Nodejs Node.Js 12.8.1 Nodejs Node.Js 12.9.0 Nodejs Node.Js 12.9.1 Nodejs Node.Js 12.10.0 Nodejs Node.Js 12.11.0 Nodejs Node.Js 12.11.1 Nodejs Node.Js 12.12.0 Nodejs Node.Js 12.13.0 Nodejs Node.Js 12.13.1 Nodejs Node.Js 12.14.0 Nodejs Node.Js 12.14.1 Nodejs Node.Js 12.15.0 Nodejs Node.Js 12.16.0 Nodejs Node.Js 12.16.1 Nodejs Node.Js 12.16.2 Nodejs Node.Js 12.16.3 Nodejs Node.Js 12.17.0 Nodejs Node.Js 12.18.0 Nodejs Node.Js 12.18.1 Nodejs Node.Js 12.18.2 Nodejs Node.Js 12.18.3 Nodejs Node.Js 12.18.4 Nodejs Node.Js 12.19.0 Nodejs Node.Js 12.19.1 Nodejs Node.Js 12.20.0 Nodejs Node.Js 10.0.0 Nodejs Node.Js 10.1.0 Nodejs Node.Js 10.2.0 Nodejs Node.Js 10.2.1 Nodejs Node.Js 10.3.0 Nodejs Node.Js 10.4.0 Nodejs Node.Js 10.4.1 Nodejs Node.Js 10.5.0 Nodejs Node.Js 10.6.0 Nodejs Node.Js 10.7.0 Nodejs Node.Js 10.8.0 Nodejs Node.Js 10.9.0 Nodejs Node.Js 10.10.0 Nodejs Node.Js 10.11.0 Nodejs Node.Js 10.12.0 Nodejs Node.Js 10.13.0 Nodejs Node.Js 10.14.0 Nodejs Node.Js 10.14.1 Nodejs Node.Js 10.14.2 Nodejs Node.Js 10.15.0 Nodejs Node.Js 10.15.1 Nodejs Node.Js 10.15.2 Nodejs Node.Js 10.15.3 Nodejs Node.Js 10.16.0 Nodejs Node.Js 10.16.1 Nodejs Node.Js 10.16.2 Nodejs Node.Js 10.16.3 Nodejs Node.Js 10.17.0 Nodejs Node.Js 10.18.0 Nodejs Node.Js 10.18.1 Nodejs Node.Js 10.19.0 Nodejs Node.Js 10.20.0 Nodejs Node.Js 10.20.1 Nodejs Node.Js 10.21.0 Nodejs Node.Js 10.22.0 Nodejs Node.Js 10.22.1 Nodejs Node.Js 10.23.0	101
Application	Oracle Oracle Graalvm 19.3.4 Oracle Graalvm 20.3.0	2
Application	Siemens Siemens Sinec Infrastructure Network Services - Siemens Sinec Infrastructure Network Services 1.0.1	2
OS	Debian Debian Debian Linux 10.0	1
OS	Fedoraproject Fedoraproject Fedora 32 Fedoraproject Fedora 33	2

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References