CVE-2020-8172 : TLS session reuse can lead to host certificate verification bypass in node versi

Products affected by CVE-2020-8172

Oracle » Mysql Cluster
Versions from including (>=) 7.4.0 and up to, including, (<=) 7.4.29
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Cluster
Versions from including (>=) 7.5.0 and up to, including, (<=) 7.5.19
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Cluster
Versions up to, including, (<=) 7.3.30
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Cluster
Versions from including (>=) 8.0.0 and up to, including, (<=) 8.0.21
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Cluster
Versions from including (>=) 7.6.0 and up to, including, (<=) 7.6.15
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
Matching versions
Oracle » Graalvm » Version: 19.3.2 Enterprise Edition
cpe:2.3:a:oracle:graalvm:19.3.2:*:*:*:enterprise:*:*:*
Matching versions
Oracle » Graalvm » Version: 20.1.0 Enterprise Edition
cpe:2.3:a:oracle:graalvm:20.1.0:*:*:*:enterprise:*:*:*
Matching versions
Oracle » Banking Extensibility Workbench » Version: 14.3.0
cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*
Matching versions
Oracle » Banking Extensibility Workbench » Version: 14.4.0
cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:*
Matching versions
Oracle » Blockchain Platform
Versions before (<) 21.1.2
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
Matching versions
Nodejs » Node.js
Versions from including (>=) 14.0.0 and before (<) 14.4.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
Matching versions
Nodejs » Node.js
Versions from including (>=) 12.0.0 and before (<) 12.18.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-8172

EPSS FAQ

0.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 66 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-8172

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:N	8.6	4.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
7.4	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	2.2	5.2	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2020-8172

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-8172

https://www.oracle.com/security-alerts/cpuoct2020.html

Oracle Critical Patch Update Advisory - October 2020
Patch;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpuapr2022.html

Oracle Critical Patch Update Advisory - April 2022
Patch;Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202101-07

NodeJS: Multiple vulnerabilities (GLSA 202101-07) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpujul2020.html

Oracle Critical Patch Update Advisory - July 2020
Patch;Third Party Advisory

CVEs referencing this url
https://www.oracle.com//security-alerts/cpujul2021.html

Oracle Critical Patch Update Advisory - July 2021
Not Applicable;Third Party Advisory

CVEs referencing this url
https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/

June 2020 Security Releases | Node.js
Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2021.html

Oracle Critical Patch Update Advisory - January 2021
Patch;Third Party Advisory

CVEs referencing this url
https://hackerone.com/reports/811502

HackerOne
Exploit;Third Party Advisory
https://security.netapp.com/advisory/ntap-20200625-0002/

CVE-2020-8172 Nodejs Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory

Vulnerability Details : CVE-2020-8172

Products affected by CVE-2020-8172

Exploit prediction scoring system (EPSS) score for CVE-2020-8172

CVSS scores for CVE-2020-8172

CWE ids for CVE-2020-8172

References for CVE-2020-8172