GHSA-ch6p-4jcm-h8vhMedium

Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core

Published
October 16, 2018
Last Modified
February 28, 2024

🔗 CVE IDs covered (1)

CVE-2017-0248 →

📋 Description

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

🎯 Affected products38

  • nuget/Microsoft.AspNetCore.Mvc:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Core:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Core:>= 1.1.0, < 1.1.3
  • nuget/System.Net.Http:= 4.1.1
  • nuget/System.Net.Http:= 4.3.1
  • nuget/System.Text.Encodings.Web:= 4.0.0
  • nuget/System.Text.Encodings.Web:= 4.3.0
  • nuget/System.Net.Http.WinHttpHandler:= 4.0.0
  • nuget/System.Net.Http.WinHttpHandler:= 4.3.0
  • nuget/System.Net.Security:= 4.0.0
  • nuget/System.Net.Security:= 4.3.0
  • nuget/System.Net.WebSockets.Client:= 4.0.0
  • nuget/System.Net.WebSockets.Client:= 4.3.0
  • nuget/Microsoft.AspNetCore.Mvc.Abstractions:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Abstractions:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.ApiExplorer:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.ApiExplorer:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Cors:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Cors:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.DataAnnotations:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.DataAnnotations:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Formatters.Json:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Formatters.Json:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Formatters.Xml:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Formatters.Xml:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Localization:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Localization:>= 1.1.0, < 1.1.3
  • nuget/Microsoft.AspNetCore.Mvc.Razor.Host:>= 1.0.0, < 1.0.4
  • nuget/Microsoft.AspNetCore.Mvc.Razor.Host:>= 1.1.0, < 1.1.3
  • +8 more not shown

🔗 References (4)