CVE-2020-8252

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type

GIT

Repo

https://github.com/nodejs/node

Events

Introduced

cf41627411886000429bde058a6594fb7f6d6d47

Fixed

b401aa24d7ab8b1fb804844df70472c3679696b9

Introduced

2f45ad8060e13d5ac912335096d21526f2f9602b

Fixed

1d60ea4c3ab35e0ec36305ad6e39eda8f07250cb

Introduced

73aa21658dfa6a22c06451d080152b32b1f98dbe

Fixed

3153c2d3833a8a46d92fde33d2773e63ef21357b

Introduced

Last affected

5ecd1c93d88c7637c76e3d2108061623efdc5e4e

Database specific

{
    "versions": [
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.22.1"
        },
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.18.4"
        },
        {
            "introduced": "14.0.0"
        },
        {
            "fixed": "14.9.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.2"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8252.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "33"
            }
        ]
    }
]