This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-8277 →

DEBIAN-CVE-2020-8277

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2...

Original description

The description as published by the source.

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 c-ares

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1"}]}]

Debian:13 c-ares

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1"}]}]

Debian:14 c-ares

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1"}]}]

References

advisory security-tracker.debian.org