CVE-2020-8172
- Source
- https://cve.org/CVERecord?id=CVE-2020-8172
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8172.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-8172
- Aliases
- Downstream
- Related
- Published
- 2020-06-08T14:15:13.213Z
- Modified
- 2026-04-10T04:28:18.931703Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
- References
-
- https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/
- https://security.gentoo.org/glsa/202101-07
- https://security.netapp.com/advisory/ntap-20200625-0002/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://hackerone.com/reports/811502
Affected packages
Git / github.com/graalvm/graalvm-ce-builds
Affected ranges
- Type
- GIT
- Repo
- https://github.com/graalvm/graalvm-ce-builds
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
- Database specific
{ "versions": [ { "introduced": "0" }, { "last_affected": "19.3.2" } ] }
- Type
- GIT
- Repo
- https://github.com/nodejs/node
- Events
-
IntroducedFixedIntroducedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affected
- Database specific
{ "versions": [ { "introduced": "12.0.0" }, { "fixed": "12.18.0" }, { "introduced": "14.0.0" }, { "fixed": "14.4.0" }, { "introduced": "0" }, { "last_affected": "14.3.0" }, { "introduced": "0" }, { "last_affected": "14.4.0" }, { "introduced": "0" }, { "last_affected": "20.1.0" } ] }
Affected versions
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.6
v0.1.0
v0.1.1
v0.1.10
v0.1.100
v0.1.101
v0.1.102
v0.1.103
v0.1.104
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.19
v0.1.2
v0.1.20
v0.1.21
v0.1.22
v0.1.23
v0.1.24
v0.1.25
v0.1.26
v0.1.27
v0.1.28
v0.1.29
v0.1.3
v0.1.30
v0.1.31
v0.1.32
v0.1.33
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.1.92
v0.1.93
v0.1.94
v0.1.95
v0.1.96
v0.1.97
v0.1.98
v0.1.99
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.4.0
v0.5.0
v0.5.1
v0.5.10
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.5-rc1
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.6.1
v0.7.0
v0.7.2
v0.7.3
v1.*
v1.0.1
v1.0.1-release
v1.0.2
v1.0.2-release
v1.0.3
v1.0.4
v1.1.0
v1.2.0
v1.3.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.7.0
v1.7.1
v12.*
v12.0.0
v12.1.0
v12.10.0
v12.11.0
v12.11.1
v12.12.0
v12.13.0
v12.13.1
v12.14.0
v12.14.1
v12.15.0
v12.16.0
v12.16.1
v12.16.2
v12.16.3
v12.17.0
v12.2.0
v12.3.0
v12.3.1
v12.4.0
v12.5.0
v12.6.0
v12.7.0
v12.8.0
v12.8.1
v12.9.0
v12.9.1
v14.*
v14.0.0
v14.1.0
v14.2.0
v14.3.0
v14.4.0
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.5.0
v20.*
v20.0.0
v20.1.0
v3.*
v3.0.0
vm-19.*
vm-19.3.2-pre
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8172.json"
unresolved_ranges
[
{
"events": [
{
"introduced": "0"
},
{
"fixed": "21.1.2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.3.30"
}
]
},
{
"events": [
{
"introduced": "7.4.0"
},
{
"last_affected": "7.4.29"
}
]
},
{
"events": [
{
"introduced": "7.5.0"
},
{
"last_affected": "7.5.19"
}
]
},
{
"events": [
{
"introduced": "7.6.0"
},
{
"last_affected": "7.6.15"
}
]
},
{
"events": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.21"
}
]
}
]