CVE-2020-8172

A TLS Hostname verification bypass vulnerability exists in NodeJS. This flaw allows an attacker to bypass TLS Hostname verification when a TLS client reuses HTTPS sessions.

This issue only affects the TLS 1.2 protocol, not TLS 1.3. This issue does not affect NodeJS 10.

Red Hat Quay installed NodeJS as a dependency of Yarn. It does not use NodeJS at runtime, but executes Javascript on the client's browser instead. Therefore the impact of this vulnerability on Red Hat Quay is low.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.