CVE-2020-8172

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Link	Resource
https://hackerone.com/reports/811502	Exploit Third Party Advisory
https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/	Vendor Advisory
https://security.netapp.com/advisory/ntap-20200625-0002/	Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html	Patch Third Party Advisory
https://security.gentoo.org/glsa/202101-07	Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html	Patch Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html	Not Applicable Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory

Configuration 1

cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:graalvm:19.3.2:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:graalvm:20.1.0:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*

---

Published : 2020-06-08 02:15

Updated : 2022-05-12 03:01

---

NVD link : CVE-2020-8172

Mitre link : CVE-2020-8172

No products.

CWE-295

Improper Certificate Validation