TLS Session Reuse Vulnerability in Node.js Package - CVE-2020-8172
Summary
UBUNTU-CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0. Affects nodejs versions < 12.22.9~dfsg-1ubuntu3. Fixed in 12.22.9~dfsg-1ubuntu3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications using an event-driven, non-blocking I/O model. The package in question, nodejs, is widely used for server-side applications and is integral to many modern web services. However, a vulnerability has been identified that affects versions prior to 12.22.9~dfsg-1ubuntu3, which could lead to serious security issues.
Vulnerability Detail
The vulnerability, identified as CVE-2020-8172, arises from improper handling of TLS session reuse. This flaw can allow an attacker to bypass host certificate verification, potentially leading to man-in-the-middle attacks. The issue affects Node.js versions below 12.18.0 and 14.4.0, exposing applications to risks where secure communications could be compromised.
How To Fix
Minimum fixed version
12.22.9~dfsg-1ubuntu3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling TLS session reuse in your application configuration until the package can be updated. This can be done by setting the appropriate options in your TLS settings, though this may impact performance.
Conclusion
CVE-2020-8172 presents a significant security risk for applications using vulnerable versions of Node.js. It is crucial to update to the patched version to mitigate potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs →
FAQ
CVE-2020-8172 is a vulnerability in Node.js that allows for host certificate verification bypass due to improper handling of TLS session reuse.
Node.js versions below 12.18.0 and 14.4.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2020-8172 is 7.4, indicating a high severity level.
If immediate updates are not possible, consider implementing workarounds such as disabling TLS session reuse in your application.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
