{"id":"CVE-2020-8172","aliases":["ALPINE-CVE-2020-8172","ALSA-2020:2852","BELL-CVE-2020-8172","BIT-node-2020-8172","BIT-node-min-2020-8172","EUVD-2020-29056","GHSA-98vx-jqrx-7mq2","RHSA-2020:2847","RHSA-2020:2852","RHSA-2020:2895","RLSA-2020:2852","SUSE-SU-2020:1606-1","UBUNTU-CVE-2020-8172","openSUSE-SU-2024:11096-1"],"status":"published","title":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and ...","description":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06065,"percentile":0.93437,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2020-06-08T13:08:16Z","modified":"2026-11-03T06:32:31Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"nodejs","fixed_in":["12.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs","fixed_in":["12.18.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["12.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["14.4.0-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["12.18.0","14.4.0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["12.18.0","14.4.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.18.0"},{"introduced":"14.0.0"},{"fixed":"14.4.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.18.0"},{"introduced":"14.0.0"},{"fixed":"14.4.0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.5-1.12.18.2.1.module+el8.1.0+7232+f8b5ede5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.2-1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.5-1.12.18.2.1.module+el8.2.0+7233+61d664c1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.2-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.2-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.2-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.2-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.5-12.18.2.1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.0-1.14.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-1.2"}]}],"bundled":19}],"products":[{"vendor":"nodejs","product":"node.js"},{"vendor":"oracle","product":"banking_extensibility_workbench"},{"vendor":"oracle","product":"blockchain_platform"},{"vendor":"oracle","product":"graalvm"},{"vendor":"oracle","product":"mysql_cluster"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://hackerone.com/reports/811502","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","advisory","evidence","report"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20200625-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://security.gentoo.org/glsa/202101-07","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8172","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-98vx-jqrx-7mq2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-8172","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-2852.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-11080","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7598","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8172","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8174","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-8172","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2847","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1844929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845256","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2847.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7598","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7598","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7598","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8172","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8172","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8174","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8174","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8174","tags":["advisory"]},{"url":"https://hackerone.com/reports/784186","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11080","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11080","tags":["advisory"]},{"url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2852","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2852.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2895","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1807349","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2895.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10531","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10531","tags":["advisory"]},{"url":"https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2020:2852","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201606-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1166916","tags":["report"]},{"url":"https://bugzilla.suse.com/1172441","tags":["report"]},{"url":"https://bugzilla.suse.com/1172442","tags":["report"]},{"url":"https://bugzilla.suse.com/1172443","tags":["report"]},{"url":"https://bugzilla.suse.com/1172728","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8174","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-8172","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/#tls-session-reuse-can-lead-to-host-certificate-verification-bypass-high-cve-2020-8172","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/2e1b41a708a71ee127a5db9c750760f74db494e4","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3672","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-8172","description":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.","status":"published","published":"2020-06-08T13:08:16Z","modified":"2024-08-04T09:56:26.895Z","updated_at":"2026-11-02T14:35:51.206854Z"}],"euvd":[{"id":"EUVD-2020-29056","description":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.","status":"published","published":"2020-06-08T13:08:16Z","modified":"2024-08-04T09:56:26Z","updated_at":"2026-11-03T03:07:58.055641Z"}],"ghsa":[{"id":"GHSA-98vx-jqrx-7mq2","title":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and ...","description":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.","status":"published","published":"2022-05-24T17:19:34Z","modified":"2023-01-29T05:02:52Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:45:11.402148Z"}],"nvd":[{"id":"CVE-2020-8172","description":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.","status":"published","published":"2020-06-08T14:15:13.213Z","modified":"2026-06-17T03:25:59.283Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:05.962132Z"}],"osv":[{"id":"ALPINE-CVE-2020-8172","description":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.","status":"published","published":"2020-06-08T14:15:13.213Z","modified":"2026-11-03T06:32:31.667475452Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"BELL-CVE-2020-8172","title":"CVE-2020-8172 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:25.608276Z","modified":"2026-02-18T07:38:22.815295Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-8172","description":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.","status":"published","published":"2020-06-08T14:15:13.213Z","modified":"2026-10-24T10:30:42.462019367Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"RHSA-2020:2847","title":"Red Hat Security Advisory: nodejs:12 security update","status":"published","published":"2024-09-13T22:42:08Z","modified":"2026-10-09T10:01:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2852","title":"Red Hat Security Advisory: nodejs:12 security update","status":"published","published":"2024-09-13T22:41:24Z","modified":"2026-10-09T10:01:48Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2895","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T22:41:31Z","modified":"2026-10-15T10:01:38Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RLSA-2020:2852","title":"Important: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.2).\n\nSecurity Fix(es):\n\n* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)\n\n* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)\n\n* nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)\n\n* nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-07-07T08:52:35Z","modified":"2026-02-04T07:40:24.01288Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-8172","description":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.","status":"withdrawn","published":"2020-06-08T14:15:00Z","modified":"2025-07-16T08:15:22.437774Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"ALSA-2020:2852","title":"Important: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.2).\n\nSecurity Fix(es):\n\n* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)\n\n* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)\n\n* nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)\n\n* nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-07-07T08:52:35Z","modified":"2026-10-29T11:00:17.177842956Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-node-2020-8172","description":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.","status":"published","published":"2024-03-06T11:08:30.103Z","modified":"2026-09-08T08:48:17.58969862Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2020-8172","description":"TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.","status":"published","published":"2024-12-16T14:07:16.823Z","modified":"2026-09-08T08:48:16.758743861Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"openSUSE-SU-2024:11096-1","title":"nodejs14-14.17.5-1.2 on GA media","description":"These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:56.833198Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:1606-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nnodejs12 was updated to version 12.18.0 \t  \n\n- CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).\n- CVE-2020-8172: Fixed am issue where TLS session reuse could have led to host certificate verification bypass (bsc#1172441).\n- CVE-2020-11080: Fixed a potential denial of service when receiving unreasonably large HTTP/2 SETTINGS frames (bsc#1172442). \n\nnpm was updated to 6.13.6\n\n- CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying \n  properties of Object.prototype (bsc#1166916).\n","status":"published","published":"2020-06-11T10:10:55Z","modified":"2026-02-04T03:36:31.661302Z","updated_at":"2026-11-02T15:53:47.634847Z"}]}}