GHSA-6xh7-4v2w-36q6HighCVSS 7.5

ASP.NET Core fails to properly validate web requests

Published
October 16, 2018
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2017-0247 →

📋 Description

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

🎯 Affected products38

  • nuget/Microsoft.AspNetCore.Mvc:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Core:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Core:>= 1.1.0, < 1.1.3
  • nuget/System.Net.Http:= 4.1.1
  • nuget/System.Net.Http:= 4.3.1
  • nuget/System.Text.Encodings.Web:= 4.0.0
  • nuget/System.Text.Encodings.Web:= 4.3.0
  • nuget/System.Net.Http.WinHttpHandler:= 4.0.0
  • nuget/System.Net.Security:= 4.0.0
  • nuget/System.Net.Security:= 4.3.0
  • nuget/System.Net.WebSockets.Client:= 4.0.0
  • nuget/System.Net.WebSockets.Client:= 4.3.0
  • nuget/Microsoft.AspNetCore.Mvc.Abstractions:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Abstractions:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.ApiExplorer:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.ApiExplorer:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Cors:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Cors:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.DataAnnotations:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.DataAnnotations:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Formatters.Json:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Formatters.Json:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Formatters.Xml:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Formatters.Xml:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Localization:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Localization:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Razor.Host:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Razor.Host:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Razor:>= 1.0.0, < 1.0.4
  • +8 more not shown

🔗 References (5)