| Package | Affected versions | Patched versions |
|---|---|---|
| c-ares | < 1.16.0 | 1.16.0 |
| node.js | ≥ 12.16.3, < 12.19.1≥ 14.13.0, < 14.15.1≥ 15.0.0, < 15.2.1 | 12.19.114.15.115.2.1 |
| blockchain platform | < 21.1.2 | 21.1.2 |
| graalvm | = 19.3.4= 20.3.0 | |
| jd edwards enterpriseone tools | < 9.2.6.0 | 9.2.6.0 |
| mysql cluster | ≤ 8.0.23 | |
| retail xstore point of service | = 16.0.6= 17.0.4= 18.0.3= 19.0.2 |
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free