| Package | Affected versions | Patched versions |
|---|---|---|
| node.js | ≥ 10.0.0, < 10.23.1≥ 12.0.0, < 12.20.1≥ 14.0.0, < 14.15.4≥ 15.0.0, < 15.5.1 | 10.23.112.20.114.15.415.5.1 |
| graalvm | = 19.3.4= 20.3.0 | |
| sinec infrastructure network services | < 1.0.1.1 | 1.0.1.1 |
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free