CVE-2020-8201 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-8201 Interim 1 45 2025-05-17T02:24:15Z current 2021-05-30T14:37:52Z 2025-05-17T02:24:15Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-8201 Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2020-October/007509.html E-Mail link for SUSE-SU-2020:2812-1 https://lists.suse.com/pipermail/sle-security-updates/2020-October/007508.html E-Mail link for SUSE-SU-2020:2813-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5CMPMUA4PV5TIZ4ZIY7PTL3KUZIS2IAM/ E-Mail link for openSUSE-SU-2020:1616-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container bci/node:12 SUSE Linux Enterprise Module for Web and Scripting 15 SP1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2 SUSE Linux Enterprise Module for Web and Scripting 15 SP3 SUSE Liberty Linux 8 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 15 SP1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2 SUSE Linux Enterprise Module for Web and Scripting 15 SP3 SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 15 SP1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2 SUSE Linux Enterprise Module for Web and Scripting 15 SP3 SUSE Linux Enterprise Server 15-ESPOS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Module for Web and Scripting 15 SP1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2 SUSE Linux Enterprise Module for Web and Scripting 15 SP3 SUSE Linux Enterprise Module for Web and Scripting 15 SP1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2 SUSE Linux Enterprise Module for Web and Scripting 15 SP3 SUSE Linux Enterprise Module for Web and Scripting 15 SP1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2 SUSE Linux Enterprise Module for Web and Scripting 15 SP3 SUSE Linux Enterprise Module for Web and Scripting 15 SP1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2 SUSE Linux Enterprise Module for Web and Scripting 15 SP3 openSUSE Leap 15.2 openSUSE Tumbleweed nodejs-12.18.4-2.module+el8.2.0+8361+192e434e nodejs-devel-12.18.4-2.module+el8.2.0+8361+192e434e nodejs-docs-12.18.4-2.module+el8.2.0+8361+192e434e nodejs-full-i18n-12.18.4-2.module+el8.2.0+8361+192e434e nodejs-nodemon-1.18.3-1.module+el8.1.0+3369+37ae6a45 nodejs-packaging-17-3.module+el8.1.0+3369+37ae6a45 nodejs10 nodejs10-devel nodejs10-docs nodejs12-12.18.4-1.20.1 nodejs12-12.18.4-4.6.1 nodejs12-12.18.4-lp152.3.6.1 nodejs12-devel-12.18.4-1.20.1 nodejs12-devel-12.18.4-4.6.1 nodejs12-devel-12.18.4-lp152.3.6.1 nodejs12-docs-12.18.4-1.20.1 nodejs12-docs-12.18.4-4.6.1 nodejs12-docs-12.18.4-lp152.3.6.1 nodejs14-14.17.5-1.2 nodejs14-devel-14.17.5-1.2 nodejs14-docs-14.17.5-1.2 npm-6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e npm10 npm12-12.18.4-1.20.1 npm12-12.18.4-4.6.1 npm12-12.18.4-lp152.3.6.1 npm14-14.17.5-1.2 nodejs12-12.18.4-4.6.1 as a component of Container bci/node:12 npm12-12.18.4-4.6.1 as a component of Container bci/node:12 nodejs-12.18.4-2.module+el8.2.0+8361+192e434e as a component of SUSE Liberty Linux 8 nodejs-devel-12.18.4-2.module+el8.2.0+8361+192e434e as a component of SUSE Liberty Linux 8 nodejs-docs-12.18.4-2.module+el8.2.0+8361+192e434e as a component of SUSE Liberty Linux 8 nodejs-full-i18n-12.18.4-2.module+el8.2.0+8361+192e434e as a component of SUSE Liberty Linux 8 nodejs-nodemon-1.18.3-1.module+el8.1.0+3369+37ae6a45 as a component of SUSE Liberty Linux 8 nodejs-packaging-17-3.module+el8.1.0+3369+37ae6a45 as a component of SUSE Liberty Linux 8 npm-6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e as a component of SUSE Liberty Linux 8 nodejs12-12.18.4-1.20.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs12-devel-12.18.4-1.20.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs12-docs-12.18.4-1.20.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 npm12-12.18.4-1.20.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs12-12.18.4-4.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 nodejs12-devel-12.18.4-4.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 nodejs12-docs-12.18.4-4.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 npm12-12.18.4-4.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 nodejs12-12.18.4-4.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP3 nodejs12-devel-12.18.4-4.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP3 nodejs12-docs-12.18.4-4.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP3 npm12-12.18.4-4.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP3 nodejs12-12.18.4-lp152.3.6.1 as a component of openSUSE Leap 15.2 nodejs12-devel-12.18.4-lp152.3.6.1 as a component of openSUSE Leap 15.2 nodejs12-docs-12.18.4-lp152.3.6.1 as a component of openSUSE Leap 15.2 npm12-12.18.4-lp152.3.6.1 as a component of openSUSE Leap 15.2 nodejs14-14.17.5-1.2 as a component of openSUSE Tumbleweed nodejs14-devel-14.17.5-1.2 as a component of openSUSE Tumbleweed nodejs14-docs-14.17.5-1.2 as a component of openSUSE Tumbleweed npm14-14.17.5-1.2 as a component of openSUSE Tumbleweed nodejs10 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS nodejs10-devel as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS nodejs10-docs as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS npm10 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS nodejs10 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs10-devel as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs10-docs as a component of SUSE Linux Enterprise Module for Web and Scripting 12 npm10 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs10 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1 nodejs10-devel as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1 nodejs10-docs as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1 npm10 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1 nodejs10 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 nodejs10-devel as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 nodejs10-docs as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 npm10 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP2 nodejs10 as a component of SUSE Linux Enterprise Server 15-ESPOS nodejs10 as a component of SUSE Linux Enterprise Server 15-LTSS nodejs10-devel as a component of SUSE Linux Enterprise Server 15-LTSS nodejs10-docs as a component of SUSE Linux Enterprise Server 15-LTSS npm10 as a component of SUSE Linux Enterprise Server 15-LTSS nodejs10 as a component of SUSE Linux Enterprise Server for SAP Applications 15 nodejs10-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 nodejs10-docs as a component of SUSE Linux Enterprise Server for SAP Applications 15 npm10 as a component of SUSE Linux Enterprise Server for SAP Applications 15 Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names. CVE-2020-8201 Container bci/node:12:nodejs12-12.18.4-4.6.1 Container bci/node:12:npm12-12.18.4-4.6.1 SUSE Liberty Linux 8:nodejs-12.18.4-2.module+el8.2.0+8361+192e434e SUSE Liberty Linux 8:nodejs-devel-12.18.4-2.module+el8.2.0+8361+192e434e SUSE Liberty Linux 8:nodejs-docs-12.18.4-2.module+el8.2.0+8361+192e434e SUSE Liberty Linux 8:nodejs-full-i18n-12.18.4-2.module+el8.2.0+8361+192e434e SUSE Liberty Linux 8:nodejs-nodemon-1.18.3-1.module+el8.1.0+3369+37ae6a45 SUSE Liberty Linux 8:nodejs-packaging-17-3.module+el8.1.0+3369+37ae6a45 SUSE Liberty Linux 8:npm-6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:nodejs12-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:nodejs12-devel-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:nodejs12-docs-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:npm12-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:nodejs12-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:nodejs12-devel-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:nodejs12-docs-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:npm12-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:nodejs12-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:nodejs12-devel-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:nodejs12-docs-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:npm12-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:nodejs12-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:nodejs12-devel-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:nodejs12-docs-12.18.4-4.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:npm12-12.18.4-4.6.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-12.18.4-1.20.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-devel-12.18.4-1.20.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs12-docs-12.18.4-1.20.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm12-12.18.4-1.20.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs12-12.18.4-4.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs12-devel-12.18.4-4.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs12-docs-12.18.4-4.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm12-12.18.4-4.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP3:nodejs12-12.18.4-4.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP3:nodejs12-devel-12.18.4-4.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP3:nodejs12-docs-12.18.4-4.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP3:npm12-12.18.4-4.6.1 openSUSE Leap 15.2:nodejs12-12.18.4-lp152.3.6.1 openSUSE Leap 15.2:nodejs12-devel-12.18.4-lp152.3.6.1 openSUSE Leap 15.2:nodejs12-docs-12.18.4-lp152.3.6.1 openSUSE Leap 15.2:npm12-12.18.4-lp152.3.6.1 openSUSE Tumbleweed:nodejs14-14.17.5-1.2 openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2 openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2 openSUSE Tumbleweed:npm14-14.17.5-1.2 SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs10 SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs10-devel SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs10-docs SUSE Linux Enterprise High Performance Computing 15-LTSS:npm10 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs10 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs10-devel SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs10-docs SUSE Linux Enterprise Module for Web and Scripting 15 SP1:npm10 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs10 SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs10-devel SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs10-docs SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm10 SUSE Linux Enterprise Server 15-ESPOS:nodejs10 SUSE Linux Enterprise Server 15-LTSS:nodejs10 SUSE Linux Enterprise Server 15-LTSS:nodejs10-devel SUSE Linux Enterprise Server 15-LTSS:nodejs10-docs SUSE Linux Enterprise Server 15-LTSS:npm10 SUSE Linux Enterprise Server for SAP Applications 15:nodejs10 SUSE Linux Enterprise Server for SAP Applications 15:nodejs10-devel SUSE Linux Enterprise Server for SAP Applications 15:nodejs10-docs SUSE Linux Enterprise Server for SAP Applications 15:npm10 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L